INCIDENT 2026-08-14 01:13:02 trigger: php_procs=28 php_rss=3185MB mysql_conn=26 ================================================================== load: 3.39 1.84 2.84 32/718 1406612 ncpu:10 mem_avail: 6122MB/11729MB (52.2%) swap_used:1524MB swapout:0/s blocked(D):0 running:33 iowait:0.0% steal:0.0% php: 28 procs / 3185MB heaviest user: madalice (28 procs, 3185MB) apache: 68 procs tcp_estab: 71 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 30 3436 mysql 1 1098 nobody 68 1066 root 256 506 netdata 8 254 cpanellogin 1 43 kurri 3 37 mailman 20 22 infinium 2 17 dovenull 6 17 evolution 5 15 zabbix 1 14 corpkicks 1 12 wp-toolkit 6 11 aaa 2 10 lowrange 2 9 mailnull 2 7 dovecot 3 7 named 1 4 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 30 3468 evolution 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5882 MB Active(file): 2546 MB Inactive(file): 2101 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 535 MB CommitLimit: 9960 MB Committed_AS: 13077 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1395193 root 13:02 1348 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1404118 root 01:58 61292 /opt/imunify360/venv/bin/python3 -m imav.run 1404480 root 01:46 7504 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1386717 1 mysql 1125140 2.5 Ssl 30:39 /usr/sbin/mariadbd 1406491 1401539 madalice 240776 53.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406489 1406163 madalice 235188 58.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 200988 2.5 Ssl 45-15:03:04 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1406490 1406464 madalice 185380 42.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406492 1406160 madalice 184156 55.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406488 1397890 madalice 184112 40.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406487 1406147 madalice 182364 42.2 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406493 1403421 madalice 180336 54.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406495 1401542 madalice 177704 53.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406499 1406142 madalice 171944 50.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406494 1406361 madalice 159992 49.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 388652 382990 root 159400 0.0 S 22:39:04 spamd child 1406498 1406183 madalice 158184 42.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406496 1406181 madalice 152496 41.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406523 1406342 madalice 131228 54.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406526 1406344 madalice 104528 36.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406540 1404291 madalice 101864 67.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406567 1406347 madalice 101084 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406527 1406159 madalice 98776 40.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406574 1406360 madalice 94104 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406558 1406138 madalice 92136 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406529 1406348 madalice 91552 24.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406531 1406349 madalice 87348 25.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406564 1406314 madalice 79716 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406561 1403426 madalice 78868 38.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406560 1406178 madalice 72816 30.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406570 1406359 madalice 72504 31.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406573 1406364 madalice 67720 24.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1404118 1 root 61292 1.2 Ssl 01:58 /opt/imunify360/venv/bin/python3 -m imav.run 1406578 1406308 madalice 59852 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406602 1406179 madalice 57872 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406626 1406366 madalice 57740 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406591 1406456 madalice 56768 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406597 1403392 madalice 55540 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406618 1406353 madalice 52192 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1406623 1406363 madalice 50708 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 46816 0.0 Ss 24-15:26:12 /usr/lib/systemd/systemd-journald 1406617 1406452 madalice 45348 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1375356 1353308 cpanellogin 44256 0.0 S 50:56 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 4922 2431 netdata 42396 0.1 Sl 45-15:02:59 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1406609 1406311 evolution 41064 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1406644 1406465 madalice 36844 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1466 1 root 25712 0.0 Ss 45-15:03:03 dnsadmin - server mode 1397890 1276780 nobody 22416 0.0 S 08:15 /usr/sbin/httpd -k start 1401531 1276780 nobody 22104 0.0 S 04:23 /usr/sbin/httpd -k start 1401542 1276780 nobody 21788 0.0 S 04:22 /usr/sbin/httpd -k start 382990 1 root 21464 0.0 Ss 22:50:16 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1401539 1276780 nobody 21204 0.0 S 04:22 /usr/sbin/httpd -k start 1406156 1276780 nobody 20536 0.1 S 00:38 /usr/sbin/httpd -k start 1403421 1276780 nobody 20520 0.0 S 02:26 /usr/sbin/httpd -k start 1403392 1276780 nobody 19584 0.0 S 02:27 /usr/sbin/httpd -k start 1406157 1276780 nobody 19556 0.1 S 00:38 /usr/sbin/httpd -k start 1406162 1276780 nobody 19340 0.1 S 00:38 /usr/sbin/httpd -k start 1406366 1276780 nobody 18648 0.2 S 00:19 /usr/sbin/httpd -k start 2223 1201 root 18644 0.0 Sl 45-15:03:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1406359 1276780 nobody 18488 0.1 S 00:19 /usr/sbin/httpd -k start 1406346 1276780 nobody 18288 0.0 S 00:20 /usr/sbin/httpd -k start 1406345 1276780 nobody 18176 0.0 S 00:20 /usr/sbin/httpd -k start 1404291 1276780 nobody 18148 0.0 S 01:55 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2425 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 2424 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 173 speedlin/speedlinefencing.com.au-ssl_log 58 bigdeals/bigdeals.com.au 13 evolution/portal.evolutionerp.com.au-ssl_log 13 aaa/aaadownunder.com.au-ssl_log 9 corpkicks/corporatekicks.com.au-ssl_log 4 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 159 136.70.106.180 58 20.251.112.224 13 203.54.180.238 11 218.147.192.98 5 2401:4900:1c85:7f89:cc9c:112b:ee14:7f5d 4 118.127.40.55 2 91.92.243.248 2 8.138.104.98 2 45.156.128.66 1 91.92.243.249 1 5.255.231.112 1 51.79.160.9 1 45.66.249.187 1 45.156.128.69 1 45.156.128.68 --- top request paths across all vhosts (last 3 min) --- 25 GET /heartbeat.php 24 GET /fetch 7 GET / 6 GET /@fs/proc/self/environ 6 GET /cgi-sys/suspendedpage.cgi 4 POST /wp-cron.php 3 POST /wp-login.php 3 GET /wp-login.php 3 GET /store/hand-painted-nike-af1-roosters/ 3 GET /proxy 3 GET /@fs/etc/passwd 2 GET /static../etc/passwd 2 GET /pms 2 GET /media../etc/passwd 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /files../etc/passwd 2 GET /.env.swp 2 GET /.aws/credentials.bak 2 GET /aws/credentials --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 24 GET /fetch 6 GET /@fs/proc/self/environ 3 GET /store/hand-painted-nike-af1-roosters/ 3 GET /proxy 3 GET /@fs/etc/passwd 3 GET / 2 GET /static../etc/passwd 2 GET /pms 2 GET /media../etc/passwd 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /files../etc/passwd -- last 10 requests -- 136.70.106.180 - - [14/Aug/2026:01:13:00 +1000] "GET /s3/.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 136.70.106.180 - - [14/Aug/2026:01:13:01 +1000] "GET /aws/.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 136.70.106.180 - - [14/Aug/2026:01:13:01 +1000] "GET /pms?module=logging&file_name=../../../../../../.aws/credentials&number_of_lines=10000 HTTP/1.1" 403 6220 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://per 136.70.106.180 - - [14/Aug/2026:01:13:01 +1000] "GET /pms?module=logging&file_name=../../../../../../~/.aws/credentials&number_of_lines=10000 HTTP/1.1" 403 6220 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); co 136.70.106.180 - - [14/Aug/2026:01:12:59 +1000] "GET /aws/metadata/iam/security-credentials/ HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 136.70.106.180 - - [14/Aug/2026:01:12:59 +1000] "GET /aws/metadata/iam/security-credentials HTTP/1.1" 301 1 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 136.70.106.180 - - [14/Aug/2026:01:13:02 +1000] "GET /hidden/.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 136.70.106.180 - - [14/Aug/2026:01:13:03 +1000] "GET /public/.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 136.70.106.180 - - [14/Aug/2026:01:13:03 +1000] "GET /tmp/.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 136.70.106.180 - - [14/Aug/2026:01:13:03 +1000] "GET /vendor/.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 1 GET /zaza.php 1 GET /z60.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xr.php 1 GET /ws.php 1 GET /ws77.php 1 GET /wp-the.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wpls.php 1 GET /wp-login.php -- last 10 requests -- 20.251.112.224 - - [14/Aug/2026:01:11:30 +1000] "GET /wp-admin/options-privacy.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:31 +1000] "GET /r.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:32 +1000] "GET /elp.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:32 +1000] "GET /admin-footer.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:33 +1000] "GET /inso.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:34 +1000] "GET /sc.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:34 +1000] "GET /css/index.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:35 +1000] "GET /wp-content/plugins/admin.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:35 +1000] "GET /shiny.php HTTP/1.1" 404 5750 "-" "-" 20.251.112.224 - - [14/Aug/2026:01:11:36 +1000] "GET /403.php HTTP/1.1" 404 5750 "-" "-" == bigdeals/bigdeals.com.au == -- top paths -- 6 GET /cgi-sys/suspendedpage.cgi 1 GET /wp-login.php 1 GET /wp-admin/ 1 GET /admin.php 1 GET /administrator/index.php 1 GET /administrator/ 1 GET /admin 1 GET / -- last 10 requests -- 218.147.192.98 - - [14/Aug/2026:01:11:17 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609.1.15 (KHTML, like Gecko) Mobile/20B101 Inst 218.147.192.98 - - [14/Aug/2026:01:11:18 +1000] "GET /administrator/index.php HTTP/1.1" 302 250 "http://bigdeals.com.au/cgi-sys/suspendedpage.cgi" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609 218.147.192.98 - - [14/Aug/2026:01:11:19 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "http://bigdeals.com.au/cgi-sys/suspendedpage.cgi" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/ 218.147.192.98 - - [14/Aug/2026:01:11:20 +1000] "GET /wp-login.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609.1.15 (KHTML, like Gecko) Mobile/20B101 Instagram 365.0.0. 218.147.192.98 - - [14/Aug/2026:01:11:21 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609.1.15 (KHTML, like Gecko) Mobile/20B101 Inst 218.147.192.98 - - [14/Aug/2026:01:11:22 +1000] "GET /wp-admin/ HTTP/1.1" 302 250 "http://bigdeals.com.au/cgi-sys/suspendedpage.cgi" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609.1.15 (KHTML, 218.147.192.98 - - [14/Aug/2026:01:11:23 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "http://bigdeals.com.au/cgi-sys/suspendedpage.cgi" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/ 218.147.192.98 - - [14/Aug/2026:01:11:24 +1000] "GET /admin.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609.1.15 (KHTML, like Gecko) Mobile/20B101 Instagram 365.0.0.33. 218.147.192.98 - - [14/Aug/2026:01:11:25 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609.1.15 (KHTML, like Gecko) Mobile/20B101 Inst 218.147.192.98 - - [14/Aug/2026:01:11:27 +1000] "GET /admin HTTP/1.1" 302 250 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/609.1.15 (KHTML, like Gecko) Mobile/20B101 Instagram 365.0.0.33.88 ( --- last 30 samples (run-up to this incident) --- 2026-08-14 01:10:39 L1=1.78 run=8 blk=0 avail=7679 (65.5%) swpO=0 conn=2 myRSS=907 php=8 phpRSS=1487 ap=32 tcp=33 topuser=madalice 2026-08-14 01:10:42 L1=1.78 run=1 blk=1 avail=8905 (75.9%) swpO=0 conn=1 myRSS=908 php=0 phpRSS=0 ap=31 tcp=30 topuser=- 2026-08-14 01:10:49 L1=1.82 run=4 blk=0 avail=8210 (70.0%) swpO=0 conn=2 myRSS=908 php=4 phpRSS=833 ap=26 tcp=33 topuser=corpkicks 2026-08-14 01:10:52 L1=1.82 run=3 blk=0 avail=8820 (75.2%) swpO=0 conn=1 myRSS=908 php=1 phpRSS=139 ap=26 tcp=26 topuser=alison 2026-08-14 01:10:59 L1=1.77 run=2 blk=0 avail=8917 (76.0%) swpO=0 conn=2 myRSS=908 php=1 phpRSS=44 ap=23 tcp=29 topuser=alison 2026-08-14 01:11:02 L1=1.77 run=2 blk=0 avail=8716 (74.3%) swpO=0 conn=1 myRSS=908 php=1 phpRSS=151 ap=23 tcp=30 topuser=alison 2026-08-14 01:11:09 L1=1.97 run=5 blk=0 avail=8175 (69.7%) swpO=0 conn=2 myRSS=908 php=4 phpRSS=530 ap=24 tcp=32 topuser=tubesupplies 2026-08-14 01:11:12 L1=1.97 run=2 blk=0 avail=8463 (72.2%) swpO=0 conn=1 myRSS=908 php=1 phpRSS=150 ap=24 tcp=27 topuser=alison 2026-08-14 01:11:19 L1=1.82 run=5 blk=1 avail=8492 (72.4%) swpO=0 conn=2 myRSS=997 php=3 phpRSS=307 ap=20 tcp=26 topuser=aaa 2026-08-14 01:11:22 L1=1.82 run=1 blk=1 avail=8555 (72.9%) swpO=0 conn=1 myRSS=1016 php=1 phpRSS=150 ap=20 tcp=26 topuser=alison 2026-08-14 01:11:30 L1=1.70 run=1 blk=1 avail=8466 (72.2%) swpO=0 conn=3 myRSS=1073 php=1 phpRSS=150 ap=19 tcp=23 topuser=alison 2026-08-14 01:11:32 L1=1.70 run=2 blk=0 avail=8511 (72.6%) swpO=0 conn=1 myRSS=1089 php=1 phpRSS=79 ap=19 tcp=25 topuser=customc 2026-08-14 01:11:40 L1=1.75 run=3 blk=0 avail=8590 (73.2%) swpO=0 conn=3 myRSS=1095 php=1 phpRSS=18 ap=19 tcp=25 topuser=customc 2026-08-14 01:11:42 L1=1.75 run=4 blk=0 avail=8417 (71.8%) swpO=0 conn=2 myRSS=1095 php=1 phpRSS=138 ap=19 tcp=25 topuser=customc 2026-08-14 01:11:50 L1=1.79 run=2 blk=1 avail=8551 (72.9%) swpO=0 conn=3 myRSS=1095 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-14 01:11:52 L1=1.79 run=4 blk=0 avail=8447 (72.0%) swpO=0 conn=2 myRSS=1095 php=2 phpRSS=206 ap=18 tcp=25 topuser=madalice 2026-08-14 01:12:00 L1=1.90 run=4 blk=0 avail=8436 (71.9%) swpO=0 conn=3 myRSS=1095 php=3 phpRSS=268 ap=16 tcp=24 topuser=infinium 2026-08-14 01:12:02 L1=1.90 run=5 blk=0 avail=8316 (70.9%) swpO=0 conn=2 myRSS=1095 php=3 phpRSS=386 ap=16 tcp=24 topuser=madalice 2026-08-14 01:12:10 L1=1.76 run=2 blk=0 avail=8834 (75.3%) swpO=0 conn=3 myRSS=1096 php=1 phpRSS=40 ap=16 tcp=23 topuser=evolution 2026-08-14 01:12:12 L1=1.76 run=1 blk=0 avail=8838 (75.3%) swpO=0 conn=2 myRSS=1096 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-14 01:12:20 L1=1.49 run=2 blk=0 avail=8831 (75.3%) swpO=0 conn=3 myRSS=1096 php=1 phpRSS=40 ap=15 tcp=21 topuser=evolution 2026-08-14 01:12:22 L1=1.49 run=2 blk=0 avail=8824 (75.2%) swpO=0 conn=2 myRSS=1096 php=1 phpRSS=53 ap=15 tcp=23 topuser=madalice 2026-08-14 01:12:30 L1=2.17 run=7 blk=0 avail=8257 (70.4%) swpO=0 conn=6 myRSS=1096 php=6 phpRSS=555 ap=44 tcp=48 topuser=madalice 2026-08-14 01:12:32 L1=2.17 run=3 blk=0 avail=8551 (72.9%) swpO=0 conn=2 myRSS=1096 php=2 phpRSS=163 ap=42 tcp=44 topuser=madalice 2026-08-14 01:12:40 L1=2.74 run=5 blk=0 avail=8361 (71.3%) swpO=0 conn=6 myRSS=1097 php=4 phpRSS=438 ap=36 tcp=76 topuser=madalice 2026-08-14 01:12:42 L1=2.74 run=5 blk=0 avail=8072 (68.8%) swpO=0 conn=4 myRSS=1097 php=3 phpRSS=666 ap=42 tcp=81 topuser=madalice 2026-08-14 01:12:50 L1=2.86 run=4 blk=0 avail=8217 (70.1%) swpO=0 conn=6 myRSS=1098 php=4 phpRSS=421 ap=61 tcp=34 topuser=madalice 2026-08-14 01:12:52 L1=2.86 run=6 blk=0 avail=7861 (67.0%) swpO=0 conn=4 myRSS=1098 php=5 phpRSS=826 ap=59 tcp=37 topuser=madalice 2026-08-14 01:13:00 L1=3.39 run=19 blk=0 avail=7483 (63.8%) swpO=0 conn=6 myRSS=1098 php=16 phpRSS=1451 ap=71 tcp=59 topuser=madalice 2026-08-14 01:13:02 L1=3.39 run=33 blk=0 avail=6122 (52.2%) swpO=0 conn=26 myRSS=1098 php=28 phpRSS=3185 ap=68 tcp=71 topuser=madalice