INCIDENT 2026-08-14 01:14:04 trigger: swapout=4825/s ================================================================== load: 58.10 18.49 8.53 3/691 1407503 ncpu:10 mem_avail: 9356MB/11729MB (79.8%) swap_used:2047MB swapout:4825/s blocked(D):1 running:2 iowait:20.8% steal:0.0% php: 3 procs / 268MB heaviest user: corpkicks (1 procs, 168MB) apache: 95 procs tcp_estab: 55 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 94 963 mysql 1 473 root 255 254 corpkicks 1 171 netdata 8 167 madalice 1 64 evolution 5 42 cpanellogin 1 23 kurri 3 19 mailnull 4 15 mailman 20 15 zabbix 1 8 wp-toolkit 6 6 dovenull 6 6 dovecot 3 5 infinium 2 3 polkitd 1 2 cpanelconnecttrack 1 2 named 1 1 lowrange 2 1 --- php workers by user --- USER PROCS RSS_MB corpkicks 1 172 madalice 1 65 evolution 1 40 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 797 MB Active(file): 482 MB Inactive(file): 346 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 167 MB CommitLimit: 9960 MB Committed_AS: 8553 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1395193 root 14:03 96 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1404118 root 02:59 25984 /opt/imunify360/venv/bin/python3 -m imav.run 1404480 root 02:47 940 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1407394 1 mysql 485000 32.4 Ssl 00:07 /usr/sbin/mariadbd 1406852 1406468 corpkicks 179340 5.3 R 00:57 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 136224 2.5 Ssl 45-15:04:05 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1407474 1406923 madalice 71732 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 388652 382990 root 60792 0.0 S 22:40:05 spamd child 1407473 1406359 evolution 41880 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1404118 1 root 25984 1.3 Ssl 02:59 /opt/imunify360/venv/bin/python3 -m imav.run 159820 1 root 25308 0.0 Ss 24-15:27:13 /usr/lib/systemd/systemd-journald 1375356 1353308 cpanellogin 24136 0.0 S 51:57 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 4922 2431 netdata 18444 0.1 Sl 45-15:04:00 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1407105 1276780 nobody 18276 0.7 S 00:24 /usr/sbin/httpd -k start 1407203 1276780 nobody 18200 0.1 S 00:09 /usr/sbin/httpd -k start 1407086 1276780 nobody 18052 2.0 S 00:29 /usr/sbin/httpd -k start 1407090 1276780 nobody 17968 1.3 S 00:26 /usr/sbin/httpd -k start 1407107 1276780 nobody 17968 0.5 S 00:24 /usr/sbin/httpd -k start 1406988 1276780 nobody 17936 1.0 S 00:48 /usr/sbin/httpd -k start 382990 1 root 17908 0.0 Ss 22:51:17 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1407108 1276780 nobody 17900 0.7 S 00:24 /usr/sbin/httpd -k start 1406983 1276780 nobody 17700 0.8 S 00:48 /usr/sbin/httpd -k start 1406991 1276780 nobody 17564 0.8 S 00:48 /usr/sbin/httpd -k start 1406896 1276780 nobody 17484 0.0 S 00:53 /usr/sbin/httpd -k start 1407089 1276780 nobody 17440 1.5 S 00:26 /usr/sbin/httpd -k start 1406997 1276780 nobody 17376 0.7 S 00:48 /usr/sbin/httpd -k start 1407323 1276780 nobody 17152 0.1 S 00:08 /usr/sbin/httpd -k start 1406923 1276780 nobody 17132 0.0 S 00:50 /usr/sbin/httpd -k start 1406996 1276780 nobody 16756 0.8 S 00:48 /usr/sbin/httpd -k start 1407324 1276780 nobody 15292 0.0 S 00:08 /usr/sbin/httpd -k start 185104 2431 netdata 15064 2.0 Sl 1-04:40:23 /usr/libexec/netdata/plugins.d/apps.plugin 1 1406916 1276780 nobody 14488 0.0 S 00:51 /usr/sbin/httpd -k start 1406941 1276780 nobody 14456 0.0 S 00:49 /usr/sbin/httpd -k start 1406917 1276780 nobody 14436 0.0 S 00:51 /usr/sbin/httpd -k start 1406924 1276780 nobody 14424 0.0 S 00:50 /usr/sbin/httpd -k start 1406939 1276780 nobody 14396 0.0 S 00:49 /usr/sbin/httpd -k start 1406907 1276780 nobody 14372 0.0 S 00:52 /usr/sbin/httpd -k start 1406908 1276780 nobody 14360 0.0 S 00:52 /usr/sbin/httpd -k start 1406940 1276780 nobody 14352 0.0 S 00:49 /usr/sbin/httpd -k start 1406994 1276780 nobody 14344 0.0 S 00:48 /usr/sbin/httpd -k start 1406936 1276780 nobody 14332 0.0 S 00:49 /usr/sbin/httpd -k start 1406986 1276780 nobody 14332 0.0 S 00:48 /usr/sbin/httpd -k start 1403421 1276780 nobody 14224 0.0 S 03:27 /usr/sbin/httpd -k start 1406989 1276780 nobody 14212 0.0 S 00:48 /usr/sbin/httpd -k start 1406342 1276780 nobody 13768 0.0 S 01:21 /usr/sbin/httpd -k start 2223 1201 root 13744 0.0 Sl 45-15:04:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1406998 1276780 nobody 13448 0.7 S 00:48 /usr/sbin/httpd -k start 1407445 3828812 kurri 12888 0.0 S 00:03 dovecot/imap 1406314 1276780 nobody 12472 0.0 S 01:22 /usr/sbin/httpd -k start 1397890 1276780 nobody 11924 0.0 S 09:16 /usr/sbin/httpd -k start 1406181 1276780 nobody 11824 0.0 S 01:38 /usr/sbin/httpd -k start 1406159 1276780 nobody 11372 0.0 S 01:39 /usr/sbin/httpd -k start 1407109 281734 mailnull 11336 0.3 D 00:24 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1406359 1276780 nobody 11312 0.0 S 01:20 /usr/sbin/httpd -k start 1406942 1276780 nobody 11116 0.0 S 00:49 /usr/sbin/httpd -k start 1406990 1276780 nobody 11036 0.0 S 00:48 /usr/sbin/httpd -k start 1463 1 root 10560 0.0 Ss 45-15:04:04 tailwatchd 1406268 1471 root 10476 0.7 S 01:29 cPhulkd - dbprocessor 1406344 1276780 nobody 10384 0.0 S 01:21 /usr/sbin/httpd -k start 1401539 1276780 nobody 9740 0.0 S 05:23 /usr/sbin/httpd -k start 1406157 1276780 nobody 9144 0.0 S 01:39 /usr/sbin/httpd -k start 1204 1 zabbix 9128 0.2 Ssl 45-15:04:05 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1406471 1276780 nobody 9024 0.0 S 01:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 1406852 D - /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1407109 D - /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid --- mariadb processlist (non-sleeping) --- +----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 74 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 278 evolution/portal.evolutionerp.com.au-ssl_log 17 aaa/aaadownunder.com.au-ssl_log 13 cosgrovecreative/cosgrovecreative.com.au-ssl_log 5 speedlin/speedlinefencing.com.au-ssl_log 4 lowrange/lowrange.com.au-ssl_log 2 corpkicks/corporatekicks.com.au 1 corpkicks/corporatekicks.com.au-ssl_log 1 evolution/evolutionerp.com.au-ssl_log 1 evolution/staging.evolutionerp.com.au-ssl_log 1 infinium/infinium.net.au 1 infinium/infinium.net.au-ssl_log 1 kamcool/kamcool.com.au-ssl_log 1 speedlin/speedlinefencing.com.au 1 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 256 136.70.106.180 17 203.54.180.238 12 118.127.40.55 7 51.79.160.9 5 195.178.110.53 3 114.119.137.101 2 91.92.243.249 2 85.11.167.5 2 66.132.172.111 2 45.156.128.66 1 91.92.243.243 1 68.67.112.213 1 66.249.65.168 1 66.132.172.213 1 5.255.231.112 --- top request paths across all vhosts (last 3 min) --- 25 GET /fetch 17 GET /heartbeat.php 13 GET / 9 POST / 6 GET /@fs/proc/self/environ 4 POST /wp-login.php 4 POST /wp-cron.php 4 GET /proxy 3 GET /we-customise-shoes-australia 3 GET /redirect 3 GET /@fs/etc/passwd 3 GET /api/proxy 2 GET /store/hand-painted-nike-af1-rickmortydrip/ 2 GET /static../etc/passwd 2 GET /s3-credentials.bak 2 GET /robots.txt 2 GET /pms 2 GET /media../etc/passwd 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 25 GET /fetch 9 POST / 6 GET /@fs/proc/self/environ 4 GET /proxy 3 GET /we-customise-shoes-australia 3 GET /redirect 3 GET /@fs/etc/passwd 3 GET /api/proxy 2 GET /store/hand-painted-nike-af1-rickmortydrip/ 2 GET /static../etc/passwd 2 GET /s3-credentials.bak 2 GET /pms -- last 10 requests -- 136.70.106.180 - - [14/Aug/2026:01:13:08 +1000] "GET /aws/metadata/iam/security-credentials/ HTTP/1.1" 500 861 "https://www.madalice.com.au/aws/metadata/iam/security-credentials/" "Mozilla/5.0 (compatible; Amazonbot/0.1; 136.70.106.180 - - [14/Aug/2026:01:13:10 +1000] "GET /k8s/eks/credentials HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 136.70.106.180 - - [14/Aug/2026:01:13:03 +1000] "GET /internal-api/iam/credentials HTTP/1.1" 500 861 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 118.127.40.55 - - [14/Aug/2026:01:13:02 +1000] "POST /?wordfence_syncAttackData=1786633982.6205 HTTP/1.1" 500 861 "-" "WordPress/7.0.4; https://madalice.com.au" 136.70.106.180 - - [14/Aug/2026:01:13:13 +1000] "GET /api/v1/fetch?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/ 136.70.106.180 - - [14/Aug/2026:01:13:01 +1000] "GET /.env~ HTTP/1.1" 404 30540 "https://www.madalice.com.au/.env~" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 136.70.106.180 - - [14/Aug/2026:01:13:03 +1000] "GET /.env.production.bak HTTP/1.1" 404 30546 "https://www.madalice.com.au/.env.production.bak" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; 136.70.106.180 - - [14/Aug/2026:01:13:02 +1000] "GET /api/aws/credentials HTTP/1.1" 404 30556 "https://www.madalice.com.au/api/aws/credentials" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 118.127.40.55 - - [14/Aug/2026:01:13:04 +1000] "POST /?wordfence_syncAttackData=1786633984.2948 HTTP/1.1" 200 36586 "-" "WordPress/7.0.4; https://madalice.com.au" 118.127.40.55 - - [14/Aug/2026:01:13:03 +1000] "POST /?wordfence_syncAttackData=1786633983.8067 HTTP/1.1" 200 36587 "-" "WordPress/7.0.4; https://madalice.com.au" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 17 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:01:12:33 +1000] "GET /heartbeat.php?sentAt=1786633953&bytes=106,125,222,225&_=1786596792753 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:01:12:42 +1000] "GET /heartbeat.php?sentAt=1786633960&bytes=106,125,222,232&_=1786602370504 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:01:12:44 +1000] "GET /heartbeat.php?sentAt=1786633963&bytes=106,125,222,235&_=1786596792754 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:01:12:50 +1000] "GET /heartbeat.php?sentAt=1786633970&bytes=106,125,222,242&_=1786602370505 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:01:12:53 +1000] "GET /heartbeat.php?sentAt=1786633973&bytes=106,125,222,245&_=1786596792755 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:01:13:00 +1000] "GET /heartbeat.php?sentAt=1786633980&bytes=106,125,222,252&_=1786602370506 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:01:13:03 +1000] "GET /heartbeat.php?sentAt=1786633983&bytes=106,125,222,255&_=1786596792756 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:01:13:10 +1000] "GET /heartbeat.php?sentAt=1786633990&bytes=106,125,223,6&_=1786602370507 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:01:13:15 +1000] "GET /heartbeat.php?sentAt=1786633993&bytes=106,125,223,9&_=1786596792757 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:01:13:38 +1000] "GET /heartbeat.php?sentAt=1786634000&bytes=106,125,223,16&_=1786602370508 HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 POST /wp-login.php 2 POST /wp-cron.php 2 GET / 1 POST /mcp 1 GET /sse -- last 10 requests -- 45.156.128.66 - - [14/Aug/2026:01:12:46 +1000] "POST /mcp HTTP/1.1" 404 - "-" "python-httpx/0.28.1" 45.156.128.66 - - [14/Aug/2026:01:12:46 +1000] "GET /sse HTTP/1.1" 404 - "-" "python-httpx/0.28.1" 91.92.243.249 - - [14/Aug/2026:01:12:53 +1000] "POST /wp-login.php HTTP/1.1" 200 6196 "-" "Mozilla/5.0" 91.92.243.249 - - [14/Aug/2026:01:12:53 +1000] "POST /wp-login.php HTTP/1.1" 200 6202 "-" "Mozilla/5.0" 118.127.40.55 - - [14/Aug/2026:01:12:54 +1000] "POST /wp-cron.php?doing_wp_cron=1786633973.9461719989776611328125 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://aaadownunder.com.au" 51.79.160.9 - - [14/Aug/2026:01:13:04 +1000] "-" 408 - "-" "-" 51.79.160.9 - - [14/Aug/2026:01:13:04 +1000] "-" 408 - "-" "-" 51.79.160.9 - - [14/Aug/2026:01:13:04 +1000] "-" 408 - "-" "-" 51.79.160.9 - - [14/Aug/2026:01:13:04 +1000] "-" 408 - "-" "-" 51.79.160.9 - - [14/Aug/2026:01:13:04 +1000] "-" 408 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-14 01:11:19 L1=1.82 run=5 blk=1 avail=8492 (72.4%) swpO=0 conn=2 myRSS=997 php=3 phpRSS=307 ap=20 tcp=26 topuser=aaa 2026-08-14 01:11:22 L1=1.82 run=1 blk=1 avail=8555 (72.9%) swpO=0 conn=1 myRSS=1016 php=1 phpRSS=150 ap=20 tcp=26 topuser=alison 2026-08-14 01:11:30 L1=1.70 run=1 blk=1 avail=8466 (72.2%) swpO=0 conn=3 myRSS=1073 php=1 phpRSS=150 ap=19 tcp=23 topuser=alison 2026-08-14 01:11:32 L1=1.70 run=2 blk=0 avail=8511 (72.6%) swpO=0 conn=1 myRSS=1089 php=1 phpRSS=79 ap=19 tcp=25 topuser=customc 2026-08-14 01:11:40 L1=1.75 run=3 blk=0 avail=8590 (73.2%) swpO=0 conn=3 myRSS=1095 php=1 phpRSS=18 ap=19 tcp=25 topuser=customc 2026-08-14 01:11:42 L1=1.75 run=4 blk=0 avail=8417 (71.8%) swpO=0 conn=2 myRSS=1095 php=1 phpRSS=138 ap=19 tcp=25 topuser=customc 2026-08-14 01:11:50 L1=1.79 run=2 blk=1 avail=8551 (72.9%) swpO=0 conn=3 myRSS=1095 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-14 01:11:52 L1=1.79 run=4 blk=0 avail=8447 (72.0%) swpO=0 conn=2 myRSS=1095 php=2 phpRSS=206 ap=18 tcp=25 topuser=madalice 2026-08-14 01:12:00 L1=1.90 run=4 blk=0 avail=8436 (71.9%) swpO=0 conn=3 myRSS=1095 php=3 phpRSS=268 ap=16 tcp=24 topuser=infinium 2026-08-14 01:12:02 L1=1.90 run=5 blk=0 avail=8316 (70.9%) swpO=0 conn=2 myRSS=1095 php=3 phpRSS=386 ap=16 tcp=24 topuser=madalice 2026-08-14 01:12:10 L1=1.76 run=2 blk=0 avail=8834 (75.3%) swpO=0 conn=3 myRSS=1096 php=1 phpRSS=40 ap=16 tcp=23 topuser=evolution 2026-08-14 01:12:12 L1=1.76 run=1 blk=0 avail=8838 (75.3%) swpO=0 conn=2 myRSS=1096 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-14 01:12:20 L1=1.49 run=2 blk=0 avail=8831 (75.3%) swpO=0 conn=3 myRSS=1096 php=1 phpRSS=40 ap=15 tcp=21 topuser=evolution 2026-08-14 01:12:22 L1=1.49 run=2 blk=0 avail=8824 (75.2%) swpO=0 conn=2 myRSS=1096 php=1 phpRSS=53 ap=15 tcp=23 topuser=madalice 2026-08-14 01:12:30 L1=2.17 run=7 blk=0 avail=8257 (70.4%) swpO=0 conn=6 myRSS=1096 php=6 phpRSS=555 ap=44 tcp=48 topuser=madalice 2026-08-14 01:12:32 L1=2.17 run=3 blk=0 avail=8551 (72.9%) swpO=0 conn=2 myRSS=1096 php=2 phpRSS=163 ap=42 tcp=44 topuser=madalice 2026-08-14 01:12:40 L1=2.74 run=5 blk=0 avail=8361 (71.3%) swpO=0 conn=6 myRSS=1097 php=4 phpRSS=438 ap=36 tcp=76 topuser=madalice 2026-08-14 01:12:42 L1=2.74 run=5 blk=0 avail=8072 (68.8%) swpO=0 conn=4 myRSS=1097 php=3 phpRSS=666 ap=42 tcp=81 topuser=madalice 2026-08-14 01:12:50 L1=2.86 run=4 blk=0 avail=8217 (70.1%) swpO=0 conn=6 myRSS=1098 php=4 phpRSS=421 ap=61 tcp=34 topuser=madalice 2026-08-14 01:12:52 L1=2.86 run=6 blk=0 avail=7861 (67.0%) swpO=0 conn=4 myRSS=1098 php=5 phpRSS=826 ap=59 tcp=37 topuser=madalice 2026-08-14 01:13:00 L1=3.39 run=19 blk=0 avail=7483 (63.8%) swpO=0 conn=6 myRSS=1098 php=16 phpRSS=1451 ap=71 tcp=59 topuser=madalice 2026-08-14 01:13:02 L1=3.39 run=33 blk=0 avail=6122 (52.2%) swpO=0 conn=26 myRSS=1098 php=28 phpRSS=3185 ap=68 tcp=71 topuser=madalice 2026-08-14 01:13:10 L1=10.53 run=60 blk=0 avail=3243 (27.7%) swpO=352 conn=50 myRSS=1098 php=53 phpRSS=6715 ap=75 tcp=87 topuser=madalice 2026-08-14 01:13:15 L1=15.53 run=79 blk=0 avail=1439 (12.3%) swpO=684 conn=65 myRSS=1100 php=72 phpRSS=8840 ap=89 tcp=118 topuser=madalice 2026-08-14 01:13:21 L1=20.61 run=35 blk=64 avail=484 (4.1%) swpO=19797 conn=76 myRSS=1057 php=75 phpRSS=10390 ap=109 tcp=117 topuser=madalice 2026-08-14 01:13:25 L1=26.81 run=30 blk=59 avail=225 (1.9%) swpO=67564 conn=75 myRSS=774 php=75 phpRSS=9199 ap=108 tcp=158 topuser=madalice 2026-08-14 01:13:53 L1=63.57 run=20 blk=62 avail=681 (5.8%) swpO=2522 conn=- myRSS=0 php=81 phpRSS=6069 ap=107 tcp=192 topuser=madalice 2026-08-14 01:13:51 L1=64.81 run=10 blk=50 avail=676 (5.8%) swpO=21862 conn=- myRSS=0 php=81 phpRSS=6156 ap=106 tcp=184 topuser=madalice 2026-08-14 01:14:04 L1=62.90 run=2 blk=1 avail=9356 (79.8%) swpO=4825 conn=4 myRSS=473 php=3 phpRSS=268 ap=95 tcp=55 topuser=corpkicks 2026-08-14 01:14:04 L1=58.10 run=3 blk=1 avail=9308 (79.4%) swpO=2245 conn=3 myRSS=473 php=2 phpRSS=284 ap=95 tcp=54 topuser=corpkicks