Many AWStats Processes

AdamP · October 11, 2025, 8:43pm

SYSTEM INFORMATION
OS type and version	Ubuntu 24.04
Virtualmin version	7.40.1

I’ve been using Virtualmin for 10+ years now and never seen this many awstats processes. Any idea why this would happen and the best course of action? I blanked out the domain name in the screenshot, but it says:

/usr/bin/perl /usr/lib/cgi-bin/awstats.pl -config=domain.org -update
and
/usr/bin/perl /usr/lib/cgi-bin/awstats.pl -config=www.domain.org -update

Also, the awstats txt file for October in /home/domain/awstats is already about 20MB.

shoulders · October 12, 2025, 11:58am

just the asking the obvious, has your sites started seeing a spike in network traffic recently and this might be why you have a lot of activity?

Some times when crawlers find a new server they hammer it.

What is being access? is there a pattern?

AdamP · October 12, 2025, 1:52pm

There is a single site on this server. It’s a forum site that was moved to a new VPS and upgraded to a newer version of the forum software at the end of September.

The previous VPS was not running Virtualmin, so I don’t have an easy way to compare activity.

I don’t see any patterns or anything out of the ordinary. I do see bot/crawler activity, but it appears normal to me.

So this many AWStats processes is normal when there’s high activity?

Joe · October 12, 2025, 2:40pm

Seems like it’s never finishing. You’ll want to look to see what’s happening.

I don’t know, off-hand, where AWStats would log what it’s doing, but you could also use strace on one of the stuck PIDs to maybe see what it’s stuck on.

strace -p <PID of an AWstats process>

That shows syscalls a process is making, so it can be hard to interpret if you’re not familiar with the system lib. But, it can at least show you if it’s waiting on something (hung, just one or two lines of output) or if it’s looping on something (maybe trying to follow a cyclic link loop or something silly, which would look like a lot of the same call over and over and over). Or, if your logs really are that large and your system really is that slow and it’s actually just taking a really long time to process the logs (which would probably look like a series of syscalls looping with slightly different values, maybe).

There are other tools for seeing what a “stuck” process is doing, as well. You could use pstree to see if it’s calling some external process…maybe it’s trying to look up hostnames for IPs and that’s not working, or maybe it’s trying to use GeoIP to lookup locations and that’s not working.

AdamP · October 12, 2025, 5:57pm

Thanks for the insight, Joe!

I looked in the awstats config file and found that it’s logging to:
/var/log/apache2/access.log
But that file is empty.

I ran strace and it appeared to be looping trying to do DNS queries but failing because I had external DNS set in the network settings… OpenDNS probably started rejecting queries because some threshold was met. I changed to the loopback address and rebooted the server. It appears to be much better now. This is my first Virtualmin minimal install, hence the DNS misconfiguration. Lesson learned. Thank you!

Joe · October 12, 2025, 6:25pm

No, that’s an Apache log that it would read, not where it would write. It may not log its activities, I don’t know, it’s been years since I used AWstats. I don’t even remember how Virtualmin sets it up to run. If it’s a cronjob, you can look at the cronjob for the user the process is running as.

Also note there isn’t a single “AWstats config file” if Virtualmin is managing AWstats. It’ll have a custom configuration for each domain, because /var/log/apache2/access.log is not a log for any domain in a Virtualmin system. All domains get their own access_log and error_log.

It looks like AWstats can be configured to produce debug and error output: AWStats Documentation - Configuration directives and parameters

May be worth trying to run it yourself manually for the problem domain, and set it to spit out more messages so you can see what’s going on.

AdamP · October 12, 2025, 8:51pm

That makes perfect sense. I spoke too soon. The hung processes are back. I’ll do some digging as soon as I have time and report back.

AdamP · October 13, 2025, 1:31pm

This kind of general data is what is showing in strace:

socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\353S\1 \0\1\0\0\0\0\0\1\00235\00266\003161\003103\7in-ad"..., 55, MSG_NOSIGNAL, NULL, 0) = 55
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [143])               = 0
recvfrom(5, "\353S\201\203\0\1\0\0\0\1\0\1\00235\00266\003161\003103\7in-ad"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 143
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0

It seems like it’s still failing DNS lookups, right? Would that have anything to do with disabling “DNS for domain” in Virtualmin?

Also, the apache access log for this domain is massive:

So I suppose it is possible that it’s just taking THAT long to go through the logs since they’re so large, right?

I’m not sure how I missed this before, but the settings are under Webmin > Servers > AWStats Reporting. I think I’ve got a workaround in place by setting " Lookup IP addresses in logs" to “Never.”

Joe · October 13, 2025, 1:55pm

It’s querying the local resolver (127.0.0.53, which is usually systemd-resolved). If that resolver is slow or non-functional, it would cause AWStats to hang for a long time on every log entry.

You can solve it by fixing the resolver or by configuring AWStats to not try to resolve IPs to hostnames (which is not super useful, since most visitors will just resolve to some random ISP hostname).

You can check your local resolver with something like:

host virtualmin.com 127.0.0.53

If it’s slow or fails, you’ve got your problem identified.

AdamP · October 13, 2025, 3:05pm

That seems to have been the issue.

host virtualmin.com 127.0.0.53
-bash: host: command not found

I installed bind9-host and now it’s working. I re-enabled resolving of IPs in AWStats and will monitor.

Any idea why that wasn’t installed with the Virtualmin install script?

Thank you!!

Joe · October 13, 2025, 3:15pm

That’s a different issue. AWStats does not use host to resolve names. I was just suggesting that as a way to test your local resolver easily.

Installing host won’t solve it. I’m surprised it wasn’t already installed, though, I don’t think I’ve ever seen a Linux server that didn’t have it installed.

AdamP · October 13, 2025, 3:32pm

You’re 100% correct again. Multiple AWStats processes started collecting again, so I disabled resolving IPs again.

It responded almost instantly after installing host:

host virtualmin.com 127.0.0.53
Using domain server:
Name: 127.0.0.53
Address: 127.0.0.53#53
Aliases:

virtualmin.com has address 45.76.57.243
virtualmin.com mail is handled by 5 mail.virtualmin.com.

Joe · October 13, 2025, 3:54pm

I didn’t answer this before, and think I probably should: It’s not supposed to install it. host is not used by Virtualmin for anything and is not needed by any software Virtualmin manages. It’s just a tool for troubleshooting/testing. It makes sense to have it, and every server I’ve ever seen has it already installed.

But, anyway, since your local resolver seems to respond fast, I guess we can rule out that as being the problem.

You’ll need to run one of the hanging commands, maybe with error and debug output enabled, as mentioned earlier, to see what it’s hanging on.

Your log is quite large, but it shouldn’t take more than a few hours to complete, and the awstats report generation should only happen once per day.

ID10T · October 13, 2025, 6:04pm

Maybe use your provider DNS in case they are blocking?

AdamP · October 13, 2025, 6:10pm

I’m using root hints in BIND and loopback now, so nothing should be blocking.

AdamP · October 16, 2025, 9:36pm

I set DebugMessages=1 in the /etc/awstats/awstats.domain.org.conf file but I don’t see any output in the apache error log. I read that’s where it’s supposed to log errors. Is that right?

I also connected to the server via ssh and ran the command:
/usr/bin/perl /usr/lib/cgi-bin/awstats.pl -config=domain.org -update

But that didn’t generate any output in the putty session or the apache error log either. Am I doing something wrong?

I just enabled dns lookups about 30 minutes ago and already have 3 duplicate awstats processes running, so I guess I’ll disable it and disable dns lookups again.

Joe · October 16, 2025, 9:55pm

Not for the parsing stage. The parsing stage has nothing to do with Apache. It reads logs. It does not interact with Apache.

The Apache error log would only come into play for using the CGI interface to AWstats (viewing the reports).

No, that’s how to run it. Let it run and in another session (log in again via ssh in another terminal), look at the strace output of the process you just started. You need to see what the damned thing is taking so long to do. If it won’t produce any output, you’ll have to look at it from another angle.

Wait, what? When you say “duplicate”, you mean all for the same domain? Why is it running so often? AWstats is only supposed to run once a day (or even once a week, but I think the default is once a day). It’d be crazy to run it multiple times an hour, there’s no way it could finish that fast, and it’d be parsing logs over and over, since you’re presumably only rotating daily or weekly.

Joe · October 16, 2025, 9:56pm

But, also, if turning off DNS lookups makes it run fast enough, then you know why it’s slow: DNS is too slow for AWstats purposes (which looks up thousands or millions of names every time you run it).

AdamP · October 16, 2025, 10:51pm

Thank you for the clarification on how AWStats logs.

I did this and it looks like more of the same. Here is about 5 seconds of output:

sudo strace -p 1920084
strace: Process 1920084 attached
restart_syscall(<... resuming interrupted read ...>) = 1
ioctl(5, FIONREAD, [115])               = 0
recvfrom(5, "f\253\201\200\0\1\0\1\0\0\0\1\003179\003150\003243\003124\7in-"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 115
close(5)                                = 0
read(4, ") AppleWebKit/537.36 (KHTML, lik"..., 8192) = 8192
read(4, "\"\n185.191.171.10 - - [16/Oct/202"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, ";\361\1 \0\1\0\0\0\0\0\1\003126\00272\003221\003106\7in-a"..., 56, MSG_NOSIGNAL, NULL, 0) = 56
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [144])               = 0
recvfrom(5, ";\361\201\203\0\1\0\0\0\1\0\1\003126\00272\003221\003106\7in-a"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 144
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\306.\1 \0\1\0\0\0\0\0\1\289\003186\003120\003162\7in-a"..., 56, MSG_NOSIGNAL, NULL, 0) = 56
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [114])               = 0
recvfrom(5, "\306.\201\200\0\1\0\1\0\0\0\1\289\003186\003120\003162\7in-a"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 114
close(5)                                = 0
read(4, "-crawler)\"\n144.76.19.146 - - [16"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\232R\1 \0\1\0\0\0\0\0\1\003114\00275\003204\003116\7in-a"..., 56, MSG_NOSIGNAL, NULL, 0) = 56
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [113])               = 0
recvfrom(5, "\232R\201\200\0\1\0\1\0\0\0\1\003114\00275\003204\003116\7in-a"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 113
close(5)                                = 0
read(4, "635 \"https://www.domain.org"..., 8192) = 8192
read(4, "https://help.seranking.com/en/bl"..., 8192) = 8192
read(4, "agent/1.1 (+https://developers.f"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\306\245\1 \0\1\0\0\0\0\0\1\00222\003155\18\00246\7in-addr"..., 53, MSG_NOSIGNAL, NULL, 0) = 53
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [113])               = 0
recvfrom(5, "\306\245\201\203\0\1\0\0\0\1\0\1\00222\003155\18\00246\7in-addr"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 113
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\10B\1 \0\1\0\0\0\0\0\1\003204\00278\00213\003119\7in-ad"..., 55, MSG_NOSIGNAL, NULL, 0) = 55
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [111])               = 0
recvfrom(5, "\10B\201\200\0\1\0\1\0\0\0\1\003204\00278\00213\003119\7in-ad"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 111
close(5)                                = 0
read(4, "Oct/2025:13:13:20 -0400] \"GET /j"..., 8192) = 8192
read(4, "4.93 - - [16/Oct/2025:13:13:24 -"..., 8192) = 8192
read(4, "- - [16/Oct/2025:13:13:29 -0400]"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "3\t\1 \0\1\0\0\0\0\0\1\003119\003111\18\00246\7in-add"..., 54, MSG_NOSIGNAL, NULL, 0) = 54
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [114])               = 0
recvfrom(5, "3\t\201\203\0\1\0\0\0\1\0\1\003119\003111\18\00246\7in-add"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 114
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "F\211\1 \0\1\0\0\0\0\0\1\00273\003146\003138\003159\7in-a"..., 56, MSG_NOSIGNAL, NULL, 0) = 56
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [113])               = 0
recvfrom(5, "F\211\201\200\0\1\0\1\0\0\0\1\00273\003146\003138\003159\7in-a"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 113
close(5)                                = 0
read(4, "4.223.30.248 - - [16/Oct/2025:13"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "9\334\1 \0\1\0\0\0\0\0\1\00238\003239\00256\00242\7in-add"..., 54, MSG_NOSIGNAL, NULL, 0) = 54
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [142])               = 0
recvfrom(5, "9\334\201\203\0\1\0\0\0\1\0\1\00238\003239\00256\00242\7in-add"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 142
close(5)                                = 0
read(4, "GET /index.php?threads/eng-bar-1"..., 8192) = 8192
read(4, " Safari/537.36\"\n207.46.13.18 - -"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\214\27\1 \0\1\0\0\0\0\0\1\00279\00275\00224\285\7in-addr"..., 53, MSG_NOSIGNAL, NULL, 0) = 53
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [107])               = 0
recvfrom(5, "\214\27\201\200\0\1\0\1\0\0\0\1\00279\00275\00224\285\7in-addr"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 107
close(5)                                = 0
read(4, "OPR/92.0.0.0\"\n85.24.75.79 - - [1"..., 8192) = 8192
read(4, "ttps://www.domain.org/threa"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\274G\1 \0\1\0\0\0\0\0\1\003154\00246\00248\00236\7in-add"..., 54, MSG_NOSIGNAL, NULL, 0) = 54
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [142])               = 0
recvfrom(5, "\274G\201\203\0\1\0\0\0\1\0\1\003154\00246\00248\00236\7in-add"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 142
close(5)                                = 0
read(4, "/www.domain.org/service_wor"..., 8192) = 8192
read(4, "elp.seranking.com/en/blex-crawle"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "Q\374\1 \0\1\0\0\0\0\0\1\00267\293\003204\003116\7in-ad"..., 55, MSG_NOSIGNAL, NULL, 0) = 55
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [111])               = 0
recvfrom(5, "Q\374\201\200\0\1\0\1\0\0\0\1\00267\293\003204\003116\7in-ad"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 111
close(5)                                = 0
read(4, "36\"\n67.48.14.33 - - [16/Oct/2025"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\332\341\1 \0\1\0\0\0\0\0\1\00269\00254\00223\003113\7in-add"..., 54, MSG_NOSIGNAL, NULL, 0) = 54
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [112])               = 0
recvfrom(5, "\332\341\201\203\0\1\0\0\0\1\0\1\00269\00254\00223\003113\7in-add"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 112
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\321A\1 \0\1\0\0\0\0\0\1\003155\003153\003138\003159\7in-"..., 57, MSG_NOSIGNAL, NULL, 0) = 57
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [115])               = 0
recvfrom(5, "\321A\201\200\0\1\0\1\0\0\0\1\003155\003153\003138\003159\7in-"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 115
close(5)                                = 0
read(4, "0400] \"POST /index.php?chat/upda"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "?_\1 \0\1\0\0\0\0\0\1\003207\003208\003229\003171\7in-"..., 57, MSG_NOSIGNAL, NULL, 0) = 57
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [97])                = 0
recvfrom(5, "?_\201\200\0\1\0\1\0\0\0\1\003207\003208\003229\003171\7in-"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 97
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\27\321\1 \0\1\0\0\0\0\0\1\003158\003226\00252\00238\7in-ad"..., 55, MSG_NOSIGNAL, NULL, 0) = 55
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [55])                = 0
recvfrom(5, "\27\321\201\202\0\1\0\0\0\0\0\1\003158\003226\00252\00238\7in-ad"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 55
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\27\321\1 \0\1\0\0\0\0\0\1\003158\003226\00252\00238\7in-ad"..., 55, MSG_NOSIGNAL, NULL, 0) = 55
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [55])                = 0
recvfrom(5, "\27\321\201\202\0\1\0\0\0\0\0\1\003158\003226\00252\00238\7in-ad"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 55
close(5)                                = 0
read(4, "local/icons/regular.svg?v=176056"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\310g\1 \0\1\0\0\0\0\0\1\00271\003208\00254\0011\7in-addr"..., 53, MSG_NOSIGNAL, NULL, 0) = 53
poll([{fd=5, events=POLLIN}], 1, 5000)  = 0 (Timeout)
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\310g\1 \0\1\0\0\0\0\0\1\00271\003208\00254\0011\7in-addr"..., 53, MSG_NOSIGNAL, NULL, 0) = 53
poll([{fd=5, events=POLLIN}], 1, 5000)  = 0 (Timeout)
close(5)                                = 0
read(4, "3.0\"\n207.46.13.168 - - [16/Oct/2"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "|\242\1 \0\1\0\0\0\0\0\1\287\003237\003119\003111\7in-a"..., 56, MSG_NOSIGNAL, NULL, 0) = 56
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [113])               = 0
recvfrom(5, "|\242\201\200\0\1\0\1\0\0\0\1\287\003237\003119\003111\7in-a"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 113
close(5)                                = 0
read(4, "64) AppleWebKit/537.36 (KHTML, l"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\226\17\1 \0\1\0\0\0\0\0\1\00227\282\00274\294\7in-addr"..., 53, MSG_NOSIGNAL, NULL, 0) = 53
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [107])               = 0
recvfrom(5, "\226\17\201\200\0\1\0\1\0\0\0\1\00227\282\00274\294\7in-addr"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 107
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\362\317\1 \0\1\0\0\0\0\0\1\003139\00239\003226\00244\7in-ad"..., 55, MSG_NOSIGNAL, NULL, 0) = 55
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [118])               = 0
recvfrom(5, "\362\317\201\200\0\1\0\1\0\0\0\1\003139\00239\003226\00244\7in-ad"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 118
close(5)                                = 0
read(4, "0.0; Win64; x64) AppleWebKit/537"..., 8192) = 8192
read(4, ".65.65.121 - - [16/Oct/2025:13:1"..., 8192) = 8192
read(4, "7.36\"\n171.229.208.207 - - [16/Oc"..., 8192) = 8192
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, "\22\200\1 \0\1\0\0\0\0\0\1\00243\00215\00246\003101\7in-add"..., 54, MSG_NOSIGNAL, NULL, 0) = 54
poll([{fd=5, events=POLLIN}], 1, 5000)  = 1 ([{fd=5, revents=POLLIN}])
ioctl(5, FIONREAD, [109])               = 0
recvfrom(5, "\22\200\201\200\0\1\0\1\0\0\0\1\00243\00215\00246\003101\7in-add"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [28 => 16]) = 109
close(5)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=920, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=517, ...}, 0) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=259, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "127.0.0.1 localhost\n127.0.1.1\txf"..., 4096) = 259
read(5, "", 4096)                       = 0
close(5)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5
setsockopt(5, SOL_IP, IP_RECVERR, [1], 4) = 0
connect(5, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, 16) = 0
poll([{fd=5, events=POLLOUT}], 1, 0)    = 1 ([{fd=5, revents=POLLOUT}])
sendto(5, ":\333\1 \0\1\0\0\0\0\0\1\00212\003140\00253\0011\7in-addr"..., 53, MSG_NOSIGNAL, NULL, 0) = 53
poll([{fd=5, events=POLLIN}], 1, 5000^Cstrace: Process 1920084 detached
 <detached ...>

Yes, that’s correct. This server only has a single domain/site on it. The screenshot in my very first post was all either domain.org or www.domain.org. All of them being duplicates.

It seems to start spawning processes within a few minutes of me changing the dns lookup setting, regardless of what is configured . Without “Lookup IP addresses in logs” set to “Always,” I only see a single process appear at the scheduled daily cron job time of 13:05 for a few minutes, like it should.

I’ve had the “Lookup IP addresses in logs” set to “Always” for about 10 minutes while writing this post and already have two processes running even though I have done nothing to prompt the server to regenerate the report or anything. I just manually ran it in terminal like you suggested.

Joe · October 16, 2025, 11:09pm

It’s possible AWstats forks another process to do DNS lookups out of band, maybe? I don’t know, as I mentioned, I haven’t used it or looked at it in years. So I’m kind of guessing about this stuff.

You could find out by looking at all of the processes with strace. But, I think you probably want to figure out why it’s starting seemingly on it’s own (it’s obviously not starting on its own, something is starting it, maybe Ubuntu creates a systemd timer or cronjob for it to run, as well, and it runs through all configured logs, and so you have multiple instantiations because multiple things are starting it).

Look at the contents of the awstats package to see if it’s installing a cronjob or a .timer unit.