I noticed that one particular virtual host contains a bunch of .so files in the lib directory. Which process creates these files? Is this a function of jailkit? I'm just trying to determine why only one site has these files, and others do not. Thanks for any help!
This depends on the files, if you find the same files in /lib/... on your server then these files are from jailkit. The site contains jailkit files because it either has (or had) a jailed ssh user or a jailed cronjob.