# 2026-04-02 — Wächter Daily Log

## 18:25 UTC — Heartbeat Check

### ⚠️ WARNING: Load elevated (11.14 on 20 cores)

**Top CPU consumers:**
- `ollama runner` — 511% CPU (AI model inference, started ~18:00 UTC)
- `lsphp: ezoshosting.com/xmlrpc.php` — 84% CPU ⚠️ **suspicious** (xmlrpc attack vector)
- Multiple `lsphp` processes (everydaysprinter.com, diamondtclassics.club) — 10–38% CPU each
- MariaDB — 31% CPU sustained

**Other metrics — all nominal:**
- Disk: 60% (/dev/md2) ✅
- Memory: 23Gi/62Gi used, 39Gi available ✅
- Services: lshttpd ✅, mysql ✅, redis ✅
- openclaw-gateway: process running (PID 921655), systemctl shows inactive (likely user-level service)

**Action needed:**
- Investigate xmlrpc.php on ezoshosting.com — consider blocking or rate-limiting
- Ollama load is transient (inference job)
- Could not relay alert to main session (sandbox restriction)

## 21:40 UTC — Heartbeat Check

### ⚠️ WARNING: Signal channel restart loop

`signal-cli` user `+4915223016139` is **not registered**. Daemon exits immediately on every start, currently on auto-restart attempt 6/10. Signal messaging non-functional.

### All other systems nominal:
- Disk: 60% root (/dev/md2) ✅, 75% Nextcloud ✅
- Memory: 16/62 GiB used, 45Gi available ✅
- Load: ~4 (normal) ✅
- Swap: 18/33 GiB used (54%, long-standing)
- Services: lshttpd ✅, mysql ✅, redis ✅, openclaw-gateway (user service) ✅

**Action needed:**
- Re-register Signal number: `signal-cli -u +4915223016139 register`
- Or verify if account was deregistered intentionally
- Could not relay alert to main session (sandbox restriction)