Skip to content

cPanel Disk I/O Investigation Commands

Run these commands as root. Replace placeholders such as YYYY-MM-DD, DD, and USERNAME.

1. Check historical disk I/O

# Historical device activity from sysstat (DD = day of month, e.g. 18)
sar -d -f /var/log/sa/saDD

# Historical per-process disk activity, if atop is installed and logs were retained
atop -r /var/log/atop/atop_YYYYMMDD

In atop, press d for disk activity and p for per-process activity.

2. Check live disk activity and sort the responsible processes

# Show only processes currently issuing I/O; individual processes, not threads
iotop -oP

# Two-second refresh, retaining accumulated I/O since iotop started
iotop -oPa -d 2

# Alternative when iotop is unavailable
pidstat -d 1

Inside iotop:

  • Left/Right arrows: select the sort column.
  • Sort by DISK READ, DISK WRITE, or IO.
  • r: reverse the sort order.
  • a: toggle accumulated I/O.
  • q: quit.

3. Identify the busy storage device and its mount point

iostat -xz 1
lsblk -o NAME,MAJ:MIN,TYPE,SIZE,MOUNTPOINT
dmsetup ls --tree

For iostat, high %util, high await, and a growing avgqu-sz indicate a saturated device. Do not use svctm as a decision metric on modern/LVM storage.

4. Check cPanel backups, cron, and file-scanning activity

ls -ltr /usr/local/cpanel/logs/cpbackup/
grep -RiE "backup|error|fail|start|complete" /usr/local/cpanel/logs/cpbackup/
grep -RiE "CRON|cpbackup|imunify|clam|maldet" /var/log/cron* /var/log/messages*
grep -RiE "backup|restore" /usr/local/cpanel/logs/ /usr/local/cpanel/logs/error_log

5. Check MySQL/MariaDB

# Current activity
mysqladmin processlist
mysqladmin status

# From the MariaDB/MySQL client
mysql -e "SHOW FULL PROCESSLIST"
mysql -e "SHOW GLOBAL VARIABLES LIKE 'slow_query_log'"
mysql -e "SHOW GLOBAL VARIABLES LIKE 'long_query_time'"
mysql -e "SHOW GLOBAL VARIABLES LIKE 'min_examined_row_limit'"
mysql -e "SHOW GLOBAL STATUS LIKE 'Slow_queries'"

# Find the configured slow-query-log file
mysql -NBe "SHOW VARIABLES LIKE 'slow_query_log_file'"

# Summarize the slow log after substituting its actual path
mysqldumpslow -s t -t 20 /path/to/mysql-slow.log
mysqldumpslow -s c -t 20 /path/to/mysql-slow.log

# Error-log checks (use the path that exists)
grep -iE "error|crash|recovery|innodb|repair" /var/log/mysqld.log /var/log/mysql/error.log

6. Review PHP, WordPress, and site traffic

# Replace the timestamp pattern with the incident time
grep "18/Jul/2026:14:" /usr/local/apache/domlogs/*

# Apache and per-account PHP errors
grep -Ri "18/Jul/2026 14:" /usr/local/apache/logs/error_log /home/*/logs/error_log

# List scheduled WordPress events, if WP-CLI is installed
wp cron event list --path=/home/USERNAME/public_html

To stop visitor requests from triggering WordPress cron, add this to the site’s wp-config.php and schedule wp-cron.php through the account’s cPanel cron interface:

define('DISABLE_WP_CRON', true);

/usr/local/bin/php /home/USERNAME/public_html/wp-cron.php >/dev/null 2>&1

7. CloudLinux per-account I/O information

# Historical account I/O-limit faults
lveinfo --period=YYYY-MM-DD --by-fault=io

# Current/other reporting is available through the CloudLinux LVE Manager

8. Count and list active (non-suspended) cPanel accounts

# Count active accounts
whmapi1 --output=json listaccts | jq '[.data.acct[] | select(.suspended == 0)] | length'

# List active accounts: username and primary domain
whmapi1 --output=json listaccts | jq -r '.data.acct[] | select(.suspended == 0) | "\(.user)\t\(.domain)"'

# List active accounts with owner and package
whmapi1 --output=json listaccts | jq -r '
  .data.acct[]
  | select(.suspended == 0)
  | [.user, .domain, .owner, .plan]
  | @tsv'

# Approximate primary-domain/account mapping count
wc -l /etc/trueuserdomains

9. Other useful checks

# Large home-directory trees
du -xh /home --max-depth=2 | sort -h | tail -30

# Deleted files that remain open
lsof +L1

# Exim queue activity
grep -RiE "queue|deferred|frozen" /var/log/exim_mainlog*

Investigation order

  1. Use sar or atop to identify the exact high-I/O window.
  2. Map the affected device using lsblk and dmsetup.
  3. Correlate timestamps with backup, cron, MySQL, CloudLinux, and web/PHP logs.
  4. Use iotop -oPa -d 2 during the next event to attribute I/O to a process and account.
  5. Analyze slow-query fingerprints and fix the responsible sites, plugins, cron jobs, queries, or storage capacity.