INCIDENT 2026-08-13 03:59:41 trigger: php_rss=2065MB ================================================================== load: 2.90 1.08 0.99 15/618 434409 ncpu:10 mem_avail: 5958MB/11729MB (50.8%) swap_used:951MB swapout:0/s blocked(D):0 running:18 iowait:0.0% steal:0.0% php: 13 procs / 2065MB heaviest user: customc (12 procs, 1907MB) apache: 32 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1697 customc 10 1682 root 241 928 nobody 31 514 netdata 8 274 madalice 1 169 cpanellogin 1 46 mailman 20 30 dovenull 6 27 lowrange 2 25 wp-toolkit 6 22 mailnull 3 17 zabbix 1 15 aaa 1 13 infinium 1 12 kurri 1 11 dovecot 3 9 named 1 7 evolution 4 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB customc 9 1552 madalice 1 172 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4786 MB Active(file): 4241 MB Inactive(file): 792 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 485 MB CommitLimit: 9960 MB Committed_AS: 8202 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 02:48:25 7368 /usr/bin/imunify-agent-proxy 427314 root 14:41 3128 /bin/bash /etc/cron.daily/imunify-antivirus.cron 427315 root 14:41 1252 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 427316 root 14:41 8272 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 427356 root 14:41 14532 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1738348 3.4 Ssl 07:26:10 /usr/sbin/mariadbd 1220 1 netdata 223136 2.5 Ssl 44-17:49:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 434347 433856 customc 188824 43.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 434345 433871 customc 188012 30.6 R 00:03 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 434353 433843 customc 186256 47.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 434356 433926 madalice 183808 79.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 388651 382990 root 183320 0.0 S 01:25:43 spamd child 382990 1 root 174872 0.0 Ss 01:36:55 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 388652 382990 root 167340 0.0 S 01:25:43 spamd child 159820 1 root 134048 0.0 Ss 23-18:12:51 /usr/lib/systemd/systemd-journald 434420 433907 customc 53776 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 431778 1353308 cpanellogin 47864 0.1 S 05:10 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1353308 1 root 41800 0.0 Ss 22-01:18:13 cpsrvd (SSL) - waiting for connections 434419 433842 evolution 40860 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 40012 0.0 Sl 44-17:49:42 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 37876 0.1 Sl 44-17:49:38 /usr/libexec/netdata/plugins.d/go.d.plugin 1 382254 1 root 33092 0.0 Ss 01:37:29 lfd - sleeping 431916 1276780 nobody 22480 0.0 S 05:00 /usr/sbin/httpd -k start 432034 1276780 nobody 21668 0.0 S 04:53 /usr/sbin/httpd -k start 1469 1 root 20844 0.1 Ss 44-17:49:42 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 433417 1276780 nobody 19432 0.0 S 01:53 /usr/sbin/httpd -k start 433900 1276780 nobody 19432 0.0 S 00:50 /usr/sbin/httpd -k start 433416 1276780 nobody 19064 0.0 S 01:53 /usr/sbin/httpd -k start 433929 1276780 nobody 18972 0.0 S 00:50 /usr/sbin/httpd -k start 433899 1276780 nobody 18776 0.0 S 00:50 /usr/sbin/httpd -k start 433418 1276780 nobody 18672 0.0 S 01:53 /usr/sbin/httpd -k start 433915 1276780 nobody 18616 0.0 S 00:50 /usr/sbin/httpd -k start 433917 1276780 nobody 18544 0.0 S 00:50 /usr/sbin/httpd -k start 433380 1276780 nobody 18452 0.0 S 01:55 /usr/sbin/httpd -k start 433911 1276780 nobody 18356 0.0 S 00:50 /usr/sbin/httpd -k start 433871 1276780 nobody 18260 0.0 S 00:51 /usr/sbin/httpd -k start 433843 1276780 nobody 17932 0.0 S 00:54 /usr/sbin/httpd -k start 433847 1276780 nobody 17848 0.0 S 00:53 /usr/sbin/httpd -k start 433842 1276780 nobody 17832 0.0 S 00:54 /usr/sbin/httpd -k start 433844 1276780 nobody 17744 0.0 S 00:53 /usr/sbin/httpd -k start 433863 1276780 nobody 17744 0.0 S 00:51 /usr/sbin/httpd -k start 185104 2431 netdata 17740 1.9 Sl 07:26:01 /usr/libexec/netdata/plugins.d/apps.plugin 1 433926 1276780 nobody 17696 0.0 S 00:50 /usr/sbin/httpd -k start 433927 1276780 nobody 17696 0.0 S 00:50 /usr/sbin/httpd -k start 433912 1276780 nobody 17672 0.0 S 00:50 /usr/sbin/httpd -k start 433861 1276780 nobody 17504 0.0 S 00:51 /usr/sbin/httpd -k start 433909 1276780 nobody 17292 0.0 S 00:50 /usr/sbin/httpd -k start 433856 1276780 nobody 16888 0.0 S 00:51 /usr/sbin/httpd -k start 433865 1276780 nobody 16800 0.0 S 00:51 /usr/sbin/httpd -k start 433902 1276780 nobody 16672 0.0 S 00:50 /usr/sbin/httpd -k start 433869 1276780 nobody 16196 0.0 S 00:51 /usr/sbin/httpd -k start 1204 1 zabbix 16092 0.2 Ssl 44-17:49:43 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 433907 1276780 nobody 15916 0.0 S 00:50 /usr/sbin/httpd -k start 433866 1276780 nobody 15880 0.0 S 00:51 /usr/sbin/httpd -k start 427356 427316 root 14532 0.0 SN 14:41 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 1463 1 root 14452 0.0 Ss 44-17:49:42 tailwatchd 374784 3828812 aaa 13504 0.0 S 01:50:45 dovecot/imap 367498 3828812 lowrange 12988 0.0 S 02:04:14 dovecot/imap 273730 3828812 lowrange 12772 0.0 S 04:51:16 dovecot/imap 347756 3828812 infinium 12432 0.0 S 02:39:52 dovecot/imap 383627 3828812 kurri 11784 0.0 S 01:36:14 dovecot/imap 837413 1471 root 10124 0.0 S 3-08:50:51 cPhulkd - dbprocessor 1805633 3828812 dovenull 8892 0.0 S 2-12:26:49 dovecot/imap-login 427316 427314 root 8272 0.0 SNl 14:41 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 427293 1 root 8064 0.0 SN 14:41 ConfigServer Version Check --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 120292 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 174 infinium/infinium.net.au-ssl_log 48 evolution/portal.evolutionerp.com.au-ssl_log 28 madalice/madalice.com.au-ssl_log 9 aaa/aaadownunder.com.au-ssl_log 4 tubesupplies/tubesupplies.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 169 34.81.42.223 28 203.54.180.238 19 118.127.40.55 4 50.6.207.27 4 50.6.137.53 4 157.66.47.83 3 95.216.13.46 3 198.38.94.17 2 91.92.243.248 2 91.92.243.243 2 74.220.219.216 2 70.40.220.123 2 51.79.65.194 2 2600:1900:4180:348:0:6b6:: 2 194.164.192.228 --- top request paths across all vhosts (last 3 min) --- 28 GET /heartbeat.php 17 POST /wp-login.php 17 GET /wp-login.php 16 GET /fetch 11 POST / 10 POST /wp-cron.php 6 GET /wp-json/wp/v2/users/me 4 GET / 3 GET /proxy 3 GET /@fs/proc/self/environ 2 GET /store/hand-painted-nike-af1-badguy/ 2 GET /store/hand-painted-nike-af1-afl-st-kilda/ 2 GET /redirect 2 GET /pms 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /@fs/etc/passwd 2 GET /api/webhook 2 GET /api/v1/fetch 2 GET /api/proxy --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 16 GET /fetch 4 POST / 3 GET /proxy 3 GET /@fs/proc/self/environ 2 GET /redirect 2 GET /pms 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /@fs/etc/passwd 2 GET /api/webhook 2 GET /api/v1/fetch 2 GET /api/proxy -- last 10 requests -- 34.81.42.223 - - [13/Aug/2026:03:59:40 +1000] "GET /aws/.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 118.127.40.55 - - [13/Aug/2026:03:59:40 +1000] "POST /?wordfence_syncAttackData=1786557580.3824 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://customcentral.com.au" 118.127.40.55 - - [13/Aug/2026:03:59:40 +1000] "POST /?wordfence_syncAttackData=1786557580.532 HTTP/1.1" 200 19238 "-" "WordPress/7.0.4; https://customcentral.com.au" 34.81.42.223 - - [13/Aug/2026:03:59:40 +1000] "GET /credentials HTTP/1.1" 404 73074 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 118.127.40.55 - - [13/Aug/2026:03:59:40 +1000] "POST /?wordfence_syncAttackData=1786557580.4172 HTTP/1.1" 200 19238 "-" "WordPress/7.0.4; https://customcentral.com.au" 34.81.42.223 - - [13/Aug/2026:03:59:40 +1000] "GET /api/v1/credentials HTTP/1.1" 404 73083 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.81.42.223 - - [13/Aug/2026:03:59:39 +1000] "GET /s3/public/credentials HTTP/1.1" 404 73086 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 34.81.42.223 - - [13/Aug/2026:03:59:39 +1000] "GET /s3-credentials.bak HTTP/1.1" 404 73081 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 118.127.40.55 - - [13/Aug/2026:03:59:40 +1000] "POST /?wordfence_syncAttackData=1786557580.5288 HTTP/1.1" 200 19238 "-" "WordPress/7.0.4; https://customcentral.com.au" 34.81.42.223 - - [13/Aug/2026:03:59:39 +1000] "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 404 73107 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" == infinium/infinium.net.au-ssl_log == -- top paths -- 17 GET /wp-login.php 13 POST /wp-login.php 6 POST /wp-cron.php 6 GET /wp-json/wp/v2/users/me 5 POST / 1 GET /wp-content/plugins/fix/up.php -- last 10 requests -- 74.220.219.216 - - [13/Aug/2026:03:58:33 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 74.220.219.216 - - [13/Aug/2026:03:58:35 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 160.250.130.168 - - [13/Aug/2026:03:59:16 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 160.250.130.168 - - [13/Aug/2026:03:59:17 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133. 95.216.13.46 - - [13/Aug/2026:03:59:24 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 95.216.13.46 - - [13/Aug/2026:03:59:30 +1000] "POST /wp-login.php HTTP/1.1" 503 6562 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 118.127.40.55 - - [13/Aug/2026:03:59:35 +1000] "POST /wp-cron.php?doing_wp_cron=1786557575.0489809513092041015625 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 118.127.40.55 - - [13/Aug/2026:03:59:34 +1000] "POST /?wordfence_syncAttackData=1786557574.5782 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 118.127.40.55 - - [13/Aug/2026:03:59:35 +1000] "POST /wp-cron.php?doing_wp_cron=1786557575.7353351116180419921875 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 188.40.26.206 - - [13/Aug/2026:03:59:34 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 28 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [13/Aug/2026:03:58:37 +1000] "GET /heartbeat.php?sentAt=1786557517&bytes=106,124,180,77&_=1786510908207 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:03:58:41 +1000] "GET /heartbeat.php?sentAt=1786557522&bytes=106,124,180,82&_=1786532340803 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:03:58:51 +1000] "GET /heartbeat.php?sentAt=1786557527&bytes=106,124,180,87&_=1786510908208 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:03:58:51 +1000] "GET /heartbeat.php?sentAt=1786557532&bytes=106,124,180,92&_=1786532340804 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:03:58:57 +1000] "GET /heartbeat.php?sentAt=1786557537&bytes=106,124,180,97&_=1786510908209 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:03:59:01 +1000] "GET /heartbeat.php?sentAt=1786557542&bytes=106,124,180,102&_=1786532340805 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:03:59:07 +1000] "GET /heartbeat.php?sentAt=1786557547&bytes=106,124,180,107&_=1786510908210 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:03:59:12 +1000] "GET /heartbeat.php?sentAt=1786557552&bytes=106,124,180,112&_=1786532340806 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:03:59:17 +1000] "GET /heartbeat.php?sentAt=1786557557&bytes=106,124,180,117&_=1786510908211 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:03:59:22 +1000] "GET /heartbeat.php?sentAt=1786557562&bytes=106,124,180,122&_=1786532340807 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-13 03:57:17 L1=0.32 run=5 blk=0 avail=7712 (65.8%) swpO=0 conn=2 myRSS=1697 php=1 phpRSS=65 ap=16 tcp=21 topuser=madalice 2026-08-13 03:57:21 L1=0.37 run=1 blk=0 avail=7749 (66.1%) swpO=0 conn=1 myRSS=1697 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-13 03:57:27 L1=0.34 run=2 blk=0 avail=7745 (66.0%) swpO=0 conn=1 myRSS=1697 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-13 03:57:31 L1=0.32 run=1 blk=0 avail=7743 (66.0%) swpO=0 conn=1 myRSS=1697 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-13 03:57:37 L1=0.37 run=1 blk=0 avail=7765 (66.2%) swpO=1 conn=1 myRSS=1697 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-13 03:57:41 L1=0.34 run=1 blk=0 avail=7772 (66.3%) swpO=1 conn=1 myRSS=1697 php=0 phpRSS=0 ap=14 tcp=19 topuser=- 2026-08-13 03:57:47 L1=0.31 run=3 blk=0 avail=7738 (66.0%) swpO=0 conn=1 myRSS=1697 php=1 phpRSS=49 ap=17 tcp=27 topuser=infinium 2026-08-13 03:57:51 L1=0.29 run=2 blk=0 avail=7588 (64.7%) swpO=0 conn=1 myRSS=1697 php=1 phpRSS=131 ap=28 tcp=26 topuser=corpkicks 2026-08-13 03:57:57 L1=0.35 run=2 blk=0 avail=7685 (65.5%) swpO=0 conn=1 myRSS=1697 php=1 phpRSS=31 ap=27 tcp=28 topuser=evolution 2026-08-13 03:58:01 L1=0.32 run=1 blk=0 avail=7716 (65.8%) swpO=0 conn=1 myRSS=1697 php=0 phpRSS=0 ap=24 tcp=22 topuser=- 2026-08-13 03:58:07 L1=0.29 run=4 blk=0 avail=7630 (65.1%) swpO=0 conn=1 myRSS=1697 php=2 phpRSS=138 ap=23 tcp=29 topuser=alison 2026-08-13 03:58:11 L1=0.27 run=1 blk=0 avail=7707 (65.7%) swpO=1 conn=1 myRSS=1697 php=0 phpRSS=0 ap=23 tcp=26 topuser=- 2026-08-13 03:58:17 L1=0.25 run=2 blk=0 avail=7625 (65.0%) swpO=1 conn=1 myRSS=1697 php=2 phpRSS=153 ap=21 tcp=26 topuser=madalice 2026-08-13 03:58:21 L1=0.31 run=1 blk=0 avail=7717 (65.8%) swpO=0 conn=1 myRSS=1697 php=0 phpRSS=0 ap=22 tcp=29 topuser=- 2026-08-13 03:58:27 L1=0.44 run=1 blk=0 avail=7705 (65.7%) swpO=0 conn=2 myRSS=1697 php=1 phpRSS=39 ap=22 tcp=27 topuser=evolution 2026-08-13 03:58:31 L1=0.49 run=3 blk=0 avail=7739 (66.0%) swpO=1 conn=1 myRSS=1697 php=0 phpRSS=0 ap=20 tcp=22 topuser=- 2026-08-13 03:58:37 L1=0.53 run=2 blk=0 avail=7661 (65.3%) swpO=1 conn=2 myRSS=1697 php=2 phpRSS=160 ap=17 tcp=19 topuser=madalice 2026-08-13 03:58:41 L1=0.57 run=2 blk=0 avail=7642 (65.2%) swpO=0 conn=1 myRSS=1697 php=1 phpRSS=155 ap=16 tcp=19 topuser=alison 2026-08-13 03:58:47 L1=0.52 run=1 blk=0 avail=7754 (66.1%) swpO=0 conn=2 myRSS=1697 php=0 phpRSS=0 ap=17 tcp=57 topuser=- 2026-08-13 03:58:51 L1=0.48 run=1 blk=0 avail=7537 (64.3%) swpO=0 conn=1 myRSS=1697 php=1 phpRSS=40 ap=47 tcp=57 topuser=evolution 2026-08-13 03:58:57 L1=0.52 run=1 blk=0 avail=7334 (62.5%) swpO=0 conn=2 myRSS=1697 php=1 phpRSS=39 ap=76 tcp=33 topuser=evolution 2026-08-13 03:59:01 L1=0.56 run=3 blk=0 avail=7368 (62.8%) swpO=0 conn=1 myRSS=1697 php=0 phpRSS=0 ap=72 tcp=21 topuser=- 2026-08-13 03:59:07 L1=0.52 run=5 blk=0 avail=7020 (59.9%) swpO=0 conn=2 myRSS=1697 php=4 phpRSS=513 ap=66 tcp=23 topuser=madalice 2026-08-13 03:59:11 L1=0.63 run=3 blk=0 avail=7138 (60.9%) swpO=0 conn=3 myRSS=1697 php=2 phpRSS=341 ap=62 tcp=27 topuser=corpkicks 2026-08-13 03:59:17 L1=0.58 run=1 blk=0 avail=7374 (62.9%) swpO=0 conn=2 myRSS=1697 php=2 phpRSS=162 ap=56 tcp=24 topuser=infinium 2026-08-13 03:59:21 L1=0.54 run=1 blk=0 avail=7506 (64.0%) swpO=0 conn=3 myRSS=1697 php=0 phpRSS=0 ap=52 tcp=22 topuser=- 2026-08-13 03:59:27 L1=0.57 run=3 blk=0 avail=7456 (63.6%) swpO=0 conn=3 myRSS=1697 php=2 phpRSS=149 ap=46 tcp=22 topuser=madalice 2026-08-13 03:59:31 L1=1.97 run=5 blk=0 avail=7302 (62.3%) swpO=0 conn=3 myRSS=1697 php=3 phpRSS=359 ap=42 tcp=33 topuser=customc 2026-08-13 03:59:38 L1=2.37 run=18 blk=0 avail=6815 (58.1%) swpO=0 conn=3 myRSS=1697 php=8 phpRSS=875 ap=36 tcp=38 topuser=customc 2026-08-13 03:59:41 L1=2.90 run=18 blk=0 avail=5958 (50.8%) swpO=0 conn=12 myRSS=1697 php=13 phpRSS=2065 ap=32 tcp=33 topuser=customc