INCIDENT 2026-08-13 02:12:15 trigger: php_rss=1662MB mysql_conn=15 ================================================================== load: 1.51 1.17 1.21 20/645 376542 ncpu:10 mem_avail: 6540MB/11729MB (55.8%) swap_used:1180MB swapout:0/s blocked(D):0 running:18 iowait:0.0% steal:0.0% php: 14 procs / 1662MB heaviest user: madalice (13 procs, 1589MB) apache: 48 procs tcp_estab: 63 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 13 1764 mysql 1 1654 root 249 769 nobody 53 758 netdata 8 274 evolution 12 92 cpanellogin 1 55 mailman 20 26 lowrange 2 25 dovenull 6 25 wp-toolkit 6 22 zabbix 1 15 aaa 1 12 infinium 1 11 dovecot 3 9 named 1 7 mailnull 2 7 nscd 1 3 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 13 1787 evolution 1 89 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5966 MB Active(file): 3822 MB Inactive(file): 1686 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 600 MB CommitLimit: 9960 MB Committed_AS: 9588 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 01:00:59 10448 /usr/bin/imunify-agent-proxy 374302 root 04:06 60296 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1693936 3.7 Ssl 05:38:44 /usr/sbin/mariadbd 1220 1 netdata 222420 2.5 Ssl 44-16:02:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 376442 376438 madalice 210580 69.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376443 376435 madalice 208388 67.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 310241 3472245 root 167564 0.0 S 01:54:44 spamd child 159820 1 root 157860 0.0 Ss 23-16:25:25 /usr/lib/systemd/systemd-journald 376503 375278 evolution 116052 43.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 376498 376464 madalice 109816 90.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376499 376463 madalice 104520 86.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376500 376465 madalice 97916 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376502 376467 madalice 95708 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376507 376462 madalice 93696 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376505 373197 madalice 91228 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376501 376466 madalice 90272 54.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 376508 376468 madalice 72752 35.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3979356 3472245 root 70596 0.0 S 13:01:13 spamd child 374302 1 root 60296 0.5 Ssl 04:06 /opt/imunify360/venv/bin/python3 -m imav.run 356923 1353308 cpanellogin 56768 0.0 S 35:24 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3472245 1 root 48240 0.0 Ss 23:49:33 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353308 1 root 42040 0.0 Ss 21-23:30:47 cpsrvd (SSL) - waiting for connections 2223 1201 root 39712 0.0 Sl 44-16:02:16 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 39212 0.1 Sl 44-16:02:12 /usr/libexec/netdata/plugins.d/go.d.plugin 1 300286 1 root 30656 0.0 Ss 02:12:14 lfd - sleeping 376575 1469 root 25700 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 373197 1276780 nobody 21664 0.0 S 06:39 /usr/sbin/httpd -k start 373440 1276780 nobody 21576 0.0 S 06:12 /usr/sbin/httpd -k start 373187 1276780 nobody 21432 0.0 S 06:39 /usr/sbin/httpd -k start 373344 1276780 nobody 21220 0.0 S 06:22 /usr/sbin/httpd -k start 374136 1276780 nobody 21192 0.0 S 04:24 /usr/sbin/httpd -k start 375204 1276780 nobody 20280 0.0 S 02:24 /usr/sbin/httpd -k start 375281 1276780 nobody 20132 0.0 S 02:20 /usr/sbin/httpd -k start 375275 1276780 nobody 19528 0.0 S 02:20 /usr/sbin/httpd -k start 375239 1276780 nobody 19236 0.0 S 02:22 /usr/sbin/httpd -k start 374785 1276780 nobody 19124 0.0 S 03:19 /usr/sbin/httpd -k start 375278 1276780 nobody 18892 0.0 S 02:20 /usr/sbin/httpd -k start 375290 1276780 nobody 18804 0.0 S 02:20 /usr/sbin/httpd -k start 375051 1276780 nobody 18336 0.1 S 02:46 /usr/sbin/httpd -k start 376399 1276780 nobody 17540 0.2 S 00:07 /usr/sbin/httpd -k start 1469 1 root 17488 0.1 Ss 44-16:02:16 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 185104 2431 netdata 17336 1.9 Rl 05:38:35 /usr/libexec/netdata/plugins.d/apps.plugin 1 376418 1276780 nobody 15612 0.0 S 00:04 /usr/sbin/httpd -k start 376410 1276780 nobody 15576 0.0 S 00:05 /usr/sbin/httpd -k start 376437 1276780 nobody 15556 0.0 S 00:03 /usr/sbin/httpd -k start 376417 1276780 nobody 15552 0.0 S 00:04 /usr/sbin/httpd -k start 376436 1276780 nobody 15512 0.0 S 00:03 /usr/sbin/httpd -k start 1204 1 zabbix 15404 0.2 Ssl 44-16:02:17 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 376447 1276780 nobody 15020 0.0 S 00:02 /usr/sbin/httpd -k start 376472 1276780 nobody 14992 0.0 S 00:01 /usr/sbin/httpd -k start 376449 1276780 nobody 14960 0.0 S 00:02 /usr/sbin/httpd -k start 376450 1276780 nobody 14960 0.0 S 00:02 /usr/sbin/httpd -k start 376451 1276780 nobody 14960 0.0 S 00:02 /usr/sbin/httpd -k start 376460 1276780 nobody 14960 0.0 S 00:01 /usr/sbin/httpd -k start 376466 1276780 nobody 14960 0.0 S 00:01 /usr/sbin/httpd -k start 376470 1276780 nobody 14960 0.0 S 00:01 /usr/sbin/httpd -k start 376448 1276780 nobody 14956 0.0 S 00:02 /usr/sbin/httpd -k start 376463 1276780 nobody 14932 0.0 S 00:01 /usr/sbin/httpd -k start 376452 1276780 nobody 14900 0.0 S 00:02 /usr/sbin/httpd -k start 376453 1276780 nobody 14900 0.0 S 00:02 /usr/sbin/httpd -k start 376454 1276780 nobody 14900 0.0 S 00:02 /usr/sbin/httpd -k start 376459 1276780 nobody 14900 0.0 S 00:01 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 107738 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 57 evolution/evolutionerp.com.au 43 speedlin/speedlinefencing.com.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 20 madalice/madalice.com.au-ssl_log 9 infinium/infinium.net.au-ssl_log 5 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 98 172.161.1.105 28 34.53.49.166 20 203.54.180.238 14 118.127.40.55 4 34.85.229.30 2 144.76.96.116 1 114.119.146.16 1 114.119.143.14 1 114.119.143.104 1 114.119.140.234 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 9 POST / 5 POST /wp-cron.php 3 GET /wp-admin/css/colors/ 3 GET /store/new-balance-550-cartoon/ 2 GET /wp-login.php 2 GET /wp-includes/js/ 2 GET /wp-includes/images/ 2 GET /wp-includes/ID3/index.php 2 GET /wp-includes/html-api/ 2 GET /wp-includes/block-supports/ 2 GET /wp-includes/ 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-content.php.php 2 GET /wp-content/cache/ 2 GET /wp-content/admin.php 2 GET /wp-admin/network/index.php 2 GET /wp-admin/js/ 2 GET /wp-admin/images/admin.php 2 GET /wp-admin/css/colors/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 GET /wp-admin/css/colors/ 1 GET /zxz.php 1 GET /www.php 1 GET /wp-login.php 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/js/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/ID3/ 1 GET /wp-includes/html-api/ 1 GET /wp-includes/block-supports/ -- last 10 requests -- 172.161.1.105 - - [13/Aug/2026:02:11:27 +1000] "GET /zxz.php HTTP/1.1" 404 122508 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:30 +1000] "GET /www.php HTTP/1.1" 404 122508 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:32 +1000] "GET /wicked.php HTTP/1.1" 404 122511 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:35 +1000] "GET /HLA-dd.php HTTP/1.1" 404 122511 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:37 +1000] "GET /wp-content/upgrade/index.php HTTP/1.1" 301 - "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:38 +1000] "GET /wp-content/upgrade/ HTTP/1.1" 200 672 "-" "-" 118.127.40.55 - - [13/Aug/2026:02:11:39 +1000] "POST /wp-cron.php?doing_wp_cron=1786551099.8425750732421875000000 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://evolutionerp.com.au" 172.161.1.105 - - [13/Aug/2026:02:11:38 +1000] "GET /cah.php HTTP/1.1" 404 122508 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:41 +1000] "GET /wp-includes/js/tinymce/plugins/compat3x/css/ HTTP/1.1" 200 929 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:42 +1000] "GET /system_log.php HTTP/1.1" 404 122515 "-" "-" == evolution/evolutionerp.com.au == -- top paths -- 1 GET /wp-includes/js/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/html-api/ 1 GET /wp-includes/block-supports/ 1 GET /wp-includes/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content.php.php 1 GET /wp-content/cache/ 1 GET /wp-content/admin.php 1 GET /wp-admin/network/index.php 1 GET /wp-admin/js/ -- last 10 requests -- 172.161.1.105 - - [13/Aug/2026:02:11:07 +1000] "GET /wp-admin/network/index.php HTTP/1.1" 301 302 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:11 +1000] "GET /k.php HTTP/1.1" 301 281 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:13 +1000] "GET /wp-admin/js/ HTTP/1.1" 301 288 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:14 +1000] "GET /403.php HTTP/1.1" 301 283 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:17 +1000] "GET /wp-includes/images/ HTTP/1.1" 301 295 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:18 +1000] "GET /wp-content/cache/ HTTP/1.1" 301 293 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:19 +1000] "GET /gecko.php HTTP/1.1" 301 285 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:21 +1000] "GET /wp-includes/ HTTP/1.1" 301 288 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:22 +1000] "GET /aa.php HTTP/1.1" 301 282 "-" "-" 172.161.1.105 - - [13/Aug/2026:02:11:24 +1000] "GET /0x.php HTTP/1.1" 301 282 "-" "-" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 8 POST / 1 POST /wp-cron.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-speedlinefencing.com.au 1 GET /wp-json 1 GET /wp-config.php.old 1 GET /web/.env 1 GET /values.yaml 1 GET /storage/logs/laravel.log 1 GET /services/timber-fencing/ -- last 10 requests -- 34.53.49.166 - - [13/Aug/2026:02:10:17 +1000] "GET /services/ HTTP/1.1" 200 12979 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0" 34.53.49.166 - - [13/Aug/2026:02:10:17 +1000] "GET /values.yaml HTTP/1.1" 404 44492 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.53.49.166 - - [13/Aug/2026:02:10:18 +1000] "GET /api/config HTTP/1.1" 404 44492 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.53.49.166 - - [13/Aug/2026:02:10:19 +1000] "POST /api/graphql HTTP/1.1" 404 8964 "https://speedlinefencing.com.au" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0 34.53.49.166 - - [13/Aug/2026:02:10:19 +1000] "GET /services/timber-fencing/ HTTP/1.1" 200 14029 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 34.53.49.166 - - [13/Aug/2026:02:10:19 +1000] "GET /api/settings HTTP/1.1" 404 44492 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.53.49.166 - - [13/Aug/2026:02:10:19 +1000] "GET /api/v1/settings HTTP/1.1" 404 44492 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.53.49.166 - - [13/Aug/2026:02:10:20 +1000] "POST /v1/graphql HTTP/1.1" 404 8964 "https://speedlinefencing.com.au" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0. 34.53.49.166 - - [13/Aug/2026:02:10:21 +1000] "GET /api/v1/config HTTP/1.1" 404 44492 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.53.49.166 - - [13/Aug/2026:02:10:21 +1000] "GET /services/chain-wire-fencing/ HTTP/1.1" 200 13562 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537 --- last 30 samples (run-up to this incident) --- 2026-08-13 02:09:54 L1=0.58 run=3 blk=0 avail=7908 (67.4%) swpO=0 conn=2 myRSS=1653 php=1 phpRSS=80 ap=19 tcp=35 topuser=madalice 2026-08-13 02:09:55 L1=0.58 run=2 blk=0 avail=7831 (66.8%) swpO=0 conn=1 myRSS=1653 php=1 phpRSS=133 ap=23 tcp=35 topuser=madalice 2026-08-13 02:10:04 L1=0.95 run=3 blk=0 avail=7482 (63.8%) swpO=0 conn=2 myRSS=1653 php=2 phpRSS=375 ap=42 tcp=23 topuser=madalice 2026-08-13 02:10:05 L1=0.95 run=2 blk=0 avail=7663 (65.3%) swpO=0 conn=1 myRSS=1653 php=1 phpRSS=174 ap=41 tcp=24 topuser=evolution 2026-08-13 02:10:14 L1=0.89 run=11 blk=0 avail=7235 (61.7%) swpO=0 conn=2 myRSS=1653 php=9 phpRSS=917 ap=32 tcp=32 topuser=speedlin 2026-08-13 02:10:15 L1=0.89 run=11 blk=0 avail=6938 (59.2%) swpO=0 conn=1 myRSS=1653 php=16 phpRSS=1402 ap=32 tcp=49 topuser=speedlin 2026-08-13 02:10:24 L1=1.83 run=9 blk=0 avail=7348 (62.7%) swpO=0 conn=2 myRSS=1653 php=7 phpRSS=737 ap=29 tcp=35 topuser=speedlin 2026-08-13 02:10:25 L1=1.83 run=10 blk=0 avail=7025 (59.9%) swpO=0 conn=1 myRSS=1653 php=9 phpRSS=1126 ap=29 tcp=31 topuser=speedlin 2026-08-13 02:10:34 L1=1.62 run=2 blk=0 avail=7939 (67.7%) swpO=0 conn=2 myRSS=1653 php=0 phpRSS=0 ap=21 tcp=20 topuser=- 2026-08-13 02:10:35 L1=1.62 run=3 blk=0 avail=7860 (67.0%) swpO=0 conn=2 myRSS=1653 php=1 phpRSS=117 ap=20 tcp=22 topuser=evolution 2026-08-13 02:10:44 L1=1.53 run=4 blk=0 avail=7911 (67.4%) swpO=0 conn=2 myRSS=1653 php=1 phpRSS=78 ap=18 tcp=21 topuser=evolution 2026-08-13 02:10:45 L1=1.53 run=2 blk=0 avail=7815 (66.6%) swpO=0 conn=2 myRSS=1653 php=1 phpRSS=173 ap=18 tcp=21 topuser=evolution 2026-08-13 02:10:54 L1=1.52 run=2 blk=0 avail=7915 (67.5%) swpO=0 conn=2 myRSS=1653 php=1 phpRSS=73 ap=18 tcp=21 topuser=evolution 2026-08-13 02:10:55 L1=1.52 run=4 blk=0 avail=7821 (66.7%) swpO=0 conn=2 myRSS=1653 php=1 phpRSS=165 ap=18 tcp=20 topuser=evolution 2026-08-13 02:11:04 L1=1.44 run=2 blk=0 avail=7765 (66.2%) swpO=0 conn=2 myRSS=1654 php=1 phpRSS=232 ap=18 tcp=22 topuser=corpkicks 2026-08-13 02:11:05 L1=1.44 run=3 blk=0 avail=7642 (65.2%) swpO=0 conn=2 myRSS=1654 php=2 phpRSS=383 ap=18 tcp=24 topuser=corpkicks 2026-08-13 02:11:14 L1=1.29 run=2 blk=0 avail=7975 (68.0%) swpO=0 conn=2 myRSS=1654 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-13 02:11:15 L1=1.29 run=2 blk=0 avail=7912 (67.5%) swpO=0 conn=2 myRSS=1654 php=1 phpRSS=92 ap=17 tcp=21 topuser=evolution 2026-08-13 02:11:24 L1=1.09 run=1 blk=0 avail=7981 (68.0%) swpO=0 conn=2 myRSS=1654 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-13 02:11:25 L1=1.09 run=2 blk=0 avail=7901 (67.4%) swpO=0 conn=2 myRSS=1654 php=1 phpRSS=112 ap=16 tcp=20 topuser=evolution 2026-08-13 02:11:35 L1=1.08 run=1 blk=0 avail=7977 (68.0%) swpO=0 conn=2 myRSS=1654 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-13 02:11:35 L1=1.08 run=2 blk=0 avail=7865 (67.1%) swpO=0 conn=2 myRSS=1654 php=1 phpRSS=140 ap=16 tcp=22 topuser=evolution 2026-08-13 02:11:45 L1=1.06 run=3 blk=0 avail=7852 (66.9%) swpO=0 conn=2 myRSS=1654 php=2 phpRSS=180 ap=16 tcp=26 topuser=infinium 2026-08-13 02:11:45 L1=1.06 run=3 blk=0 avail=7816 (66.6%) swpO=0 conn=2 myRSS=1654 php=2 phpRSS=218 ap=16 tcp=23 topuser=infinium 2026-08-13 02:11:55 L1=0.90 run=1 blk=0 avail=7973 (68.0%) swpO=0 conn=1 myRSS=1654 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-13 02:11:55 L1=0.90 run=2 blk=0 avail=7894 (67.3%) swpO=0 conn=2 myRSS=1654 php=1 phpRSS=112 ap=16 tcp=22 topuser=evolution 2026-08-13 02:12:05 L1=0.83 run=1 blk=0 avail=7973 (68.0%) swpO=0 conn=1 myRSS=1654 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-13 02:12:05 L1=0.83 run=1 blk=0 avail=7973 (68.0%) swpO=0 conn=2 myRSS=1654 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-13 02:12:15 L1=1.51 run=10 blk=0 avail=6973 (59.5%) swpO=0 conn=1 myRSS=1654 php=6 phpRSS=1014 ap=48 tcp=55 topuser=madalice 2026-08-13 02:12:15 L1=1.51 run=18 blk=0 avail=6540 (55.8%) swpO=0 conn=15 myRSS=1654 php=14 phpRSS=1662 ap=48 tcp=63 topuser=madalice