INCIDENT 2026-08-15 04:24:51 trigger: php_rss=2193MB mysql_conn=23 ================================================================== load: 3.49 1.50 1.03 27/645 2452919 ncpu:10 mem_avail: 5375MB/11729MB (45.8%) swap_used:1151MB swapout:0/s blocked(D):0 running:24 iowait:0.0% steal:0.0% php: 23 procs / 2193MB heaviest user: customc (22 procs, 2045MB) apache: 41 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB customc 24 2293 mysql 1 2274 root 240 930 nobody 40 617 netdata 8 263 dovenull 6 28 wp-toolkit 6 20 cpanellogin 1 18 mailman 20 14 infinium 1 13 zabbix 1 12 lowrange 1 12 kurri 1 12 mailnull 2 10 dovecot 3 8 named 1 7 nscd 1 4 evolution 4 3 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB customc 24 2328 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3695 MB Active(file): 3598 MB Inactive(file): 637 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 919 MB CommitLimit: 9960 MB Committed_AS: 9002 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 03:13:37 6220 /usr/bin/imunify-agent-proxy 2444340 root 13:22 62964 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 2328704 10.9 Ssl 1-02:45:52 /usr/sbin/mariadbd 1220 1 netdata 214872 2.5 Ssl 46-18:14:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2390233 2382613 root 184672 0.0 S 01:49:15 spamd child 2382613 1 root 175196 0.0 Ss 02:01:41 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2390234 2382613 root 167364 0.0 S 01:49:15 spamd child 2452860 2448731 customc 132916 29.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452873 2452495 customc 132884 33.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452864 2452500 customc 132868 25.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452861 2452654 customc 132844 26.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452869 2452488 customc 132772 26.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452863 2452633 customc 132744 29.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452859 2452497 customc 132672 26.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452858 2452501 customc 132416 28.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452862 2452329 customc 131192 25.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452874 2452657 customc 131080 31.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452877 2452496 customc 130548 25.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452867 2450743 customc 129776 29.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452865 2452466 customc 124900 24.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452866 2452603 customc 119216 26.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452875 2452498 customc 119036 26.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452868 2452656 customc 113796 23.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452876 2448334 customc 107208 20.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452871 2448770 customc 106764 22.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452870 2452631 customc 105672 20.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452879 2452474 customc 97616 39.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452883 2452632 customc 84000 28.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452881 2452653 customc 81396 28.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2452913 2452885 customc 65980 20.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2444340 1 root 62964 0.2 Ssl 13:22 /opt/imunify360/venv/bin/python3 -m imav.run 2452908 2452655 customc 60816 14.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2223 1201 root 54560 0.0 Sl 46-18:14:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 159820 1 root 53976 0.0 Ss 25-18:38:03 /usr/lib/systemd/systemd-journald 1469 1 root 42028 0.1 Ss 46-18:14:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41796 0.0 Ss 24-01:43:25 cpsrvd (SSL) - waiting for connections 2452943 1469 root 38912 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2381704 1 root 33176 0.0 Ss 02:02:40 lfd - sleeping 4922 2431 netdata 32580 0.1 Sl 46-18:14:50 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2448731 1276780 nobody 21404 0.0 S 06:14 /usr/sbin/httpd -k start 2448770 1276780 nobody 20668 0.0 S 06:13 /usr/sbin/httpd -k start 2448769 1276780 nobody 20272 0.0 S 06:13 /usr/sbin/httpd -k start 2451284 1276780 nobody 19868 0.0 S 02:34 /usr/sbin/httpd -k start 2448795 1276780 nobody 19388 0.0 S 06:13 /usr/sbin/httpd -k start 2448334 1276780 nobody 19232 0.0 S 06:53 /usr/sbin/httpd -k start 2446242 1353308 cpanellogin 19020 0.0 S 10:00 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 2452488 1276780 nobody 18216 0.1 S 00:25 /usr/sbin/httpd -k start 2452329 1276780 nobody 17944 0.1 S 00:44 /usr/sbin/httpd -k start 2451495 1276780 nobody 17784 0.0 R 02:21 /usr/sbin/httpd -k start 2450743 1276780 nobody 17620 0.0 S 03:25 /usr/sbin/httpd -k start 2451070 1276780 nobody 17560 0.0 S 02:58 /usr/sbin/httpd -k start 2452474 1276780 nobody 16932 0.0 S 00:27 /usr/sbin/httpd -k start 2452657 1276780 nobody 16384 0.0 S 00:15 /usr/sbin/httpd -k start 2448825 1276780 nobody 16340 0.0 S 06:11 /usr/sbin/httpd -k start 2452364 1276780 nobody 16288 0.0 S 00:42 /usr/sbin/httpd -k start 2452477 1276780 nobody 15880 0.1 S 00:26 /usr/sbin/httpd -k start 2452466 1276780 nobody 15856 0.1 S 00:29 /usr/sbin/httpd -k start 2452777 1276780 nobody 15792 0.0 S 00:08 /usr/sbin/httpd -k start 2452603 1276780 nobody 15784 0.1 S 00:18 /usr/sbin/httpd -k start 2452632 1276780 nobody 15668 0.1 S 00:16 /usr/sbin/httpd -k start 2452495 1276780 nobody 15656 0.0 S 00:24 /usr/sbin/httpd -k start 2452496 1276780 nobody 15656 0.1 S 00:24 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4002089 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 111 cosgrovecreative/cosgrovecreative.com.au-ssl_log 94 alison/alisonarts.com.au-ssl_log 62 tubesupplies/tubesupplies.com.au-ssl_log 61 tubesupplies/tubesupplies.com.au 58 vinesit/westpanel.vinesit.com.au 43 vinesit/westpanel.vinesit.com.au-ssl_log 43 evolution/portal.evolutionerp.com.au-ssl_log 28 madalice/madalice.com.au-ssl_log 4 evolution/my.evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 109 34.11.22.191 106 20.104.100.201 94 20.106.102.5 86 20.250.27.191 30 45.148.10.238 28 203.54.180.238 27 20.226.112.14 10 146.70.194.220 7 118.127.40.55 1 95.56.170.61 1 66.249.65.171 1 66.249.65.170 1 57.141.16.30 1 57.141.16.13 1 52.167.144.179 --- top request paths across all vhosts (last 3 min) --- 28 GET /heartbeat.php 7 GET / 6 POST / 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 3 GET /k.php 3 GET /geck.php 3 GET /7.php 2 POST //xmlrpc.php 2 POST /wp-cron.php 2 GET /zwq.php 2 GET /zample.php 2 GET /yj09.php 2 GET /yawa.php 2 GET /xy.php 2 GET /xyn.php 2 GET /x.php 2 GET /xl2024.php 2 GET /x1da.php 2 GET /x0rg.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 3 GET / 1 POST /wp-cron.php 1 GET /wp-sitemap-taxonomies-product_cat-1.xml 1 GET /web/.env 1 GET /src/.env 1 GET /server/.env 1 GET /root/.aws/credentials 1 GET /root/.aws/config 1 GET /public/.env 1 GET /laravel/.env 1 GET /.kube/config 1 GET /.github/.env -- last 10 requests -- 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /.git-credentials HTTP/1.1" 404 73080 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /.git/HEAD HTTP/1.1" 404 73074 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /.env.old HTTP/1.1" 404 73072 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /aws-credentials HTTP/1.1" 404 73079 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /.env.swp HTTP/1.1" 404 73072 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /aws_credentials HTTP/1.1" 404 73079 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /.github/.env HTTP/1.1" 404 73077 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.11.22.191 - - [15/Aug/2026:04:24:44 +1000] "GET /.git/config HTTP/1.1" 404 73076 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.11.22.191 - - [15/Aug/2026:04:24:46 +1000] "GET /.azure/credentials HTTP/1.1" 404 73083 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.11.22.191 - - [15/Aug/2026:04:24:46 +1000] "GET /.kube/config HTTP/1.1" 404 73077 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /xxxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php 1 GET /ws38.php 1 GET /ws37.php 1 GET /ws36.php 1 GET /ws34.php 1 GET /ws33.php -- last 10 requests -- 20.106.102.5 - - [15/Aug/2026:04:22:44 +1000] "GET /file18.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:44 +1000] "GET /file21.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:45 +1000] "GET /xxw.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:45 +1000] "GET /racs3.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:45 +1000] "GET /wsd.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:46 +1000] "GET /333.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:46 +1000] "GET /12.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:46 +1000] "GET /moon3.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:46 +1000] "GET /tor.php HTTP/1.1" 401 36 "-" "-" 20.106.102.5 - - [15/Aug/2026:04:22:47 +1000] "GET /haa.php HTTP/1.1" 401 36 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 5 POST / 2 GET /storage/.env 2 GET /app/settings.py 2 GET /%00back/%00.env 1 GET /wto.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /v3.php 1 GET /this_is_a_new_hello_world.php 1 GET /symfony/%252eenv 1 GET /storage/%2eenv 1 GET /src/.env 1 GET /setup%2ephp -- last 10 requests -- 20.226.112.14 - - [15/Aug/2026:04:24:43 +1000] "GET /class20.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:44 +1000] "GET /lol.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:44 +1000] "GET /cc.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:45 +1000] "GET /o.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:46 +1000] "GET /aaa.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:47 +1000] "GET /n.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:47 +1000] "GET /666.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:48 +1000] "GET /fileas.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:49 +1000] "GET /cccc.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:24:50 +1000] "GET /CLA.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 04:22:28 L1=0.88 run=3 blk=0 avail=6838 (58.3%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=94 ap=20 tcp=22 topuser=tubesupplies 2026-08-15 04:22:31 L1=0.88 run=2 blk=0 avail=6414 (54.7%) swpO=0 conn=4 myRSS=2277 php=6 phpRSS=673 ap=21 tcp=44 topuser=alison 2026-08-15 04:22:38 L1=1.40 run=2 blk=0 avail=6811 (58.1%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=92 ap=27 tcp=22 topuser=tubesupplies 2026-08-15 04:22:41 L1=1.40 run=5 blk=0 avail=6735 (57.4%) swpO=0 conn=4 myRSS=2277 php=3 phpRSS=204 ap=27 tcp=25 topuser=alison 2026-08-15 04:22:48 L1=1.41 run=5 blk=0 avail=6791 (57.9%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=122 ap=28 tcp=24 topuser=tubesupplies 2026-08-15 04:22:51 L1=1.41 run=3 blk=0 avail=6779 (57.8%) swpO=0 conn=4 myRSS=2277 php=2 phpRSS=169 ap=27 tcp=26 topuser=tubesupplies 2026-08-15 04:22:58 L1=1.42 run=2 blk=0 avail=6787 (57.9%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=143 ap=25 tcp=25 topuser=tubesupplies 2026-08-15 04:23:01 L1=1.42 run=5 blk=0 avail=6785 (57.9%) swpO=0 conn=4 myRSS=2277 php=2 phpRSS=185 ap=23 tcp=25 topuser=tubesupplies 2026-08-15 04:23:08 L1=1.51 run=2 blk=0 avail=6878 (58.6%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=60 ap=23 tcp=23 topuser=tubesupplies 2026-08-15 04:23:11 L1=1.51 run=2 blk=0 avail=6888 (58.7%) swpO=0 conn=4 myRSS=2277 php=1 phpRSS=58 ap=23 tcp=20 topuser=tubesupplies 2026-08-15 04:23:18 L1=1.35 run=2 blk=0 avail=6832 (58.3%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=123 ap=21 tcp=24 topuser=tubesupplies 2026-08-15 04:23:21 L1=1.35 run=2 blk=0 avail=6832 (58.2%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=129 ap=21 tcp=20 topuser=tubesupplies 2026-08-15 04:23:28 L1=1.30 run=3 blk=0 avail=6929 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=20 tcp=23 topuser=- 2026-08-15 04:23:31 L1=1.30 run=1 blk=0 avail=6936 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=20 tcp=18 topuser=- 2026-08-15 04:23:39 L1=1.33 run=2 blk=0 avail=6910 (58.9%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=54 ap=20 tcp=17 topuser=speedlin 2026-08-15 04:23:41 L1=1.33 run=2 blk=0 avail=6702 (57.1%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=261 ap=20 tcp=18 topuser=madalice 2026-08-15 04:23:49 L1=1.51 run=1 blk=0 avail=6929 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=22 topuser=- 2026-08-15 04:23:51 L1=1.51 run=1 blk=0 avail=6929 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=19 topuser=- 2026-08-15 04:23:59 L1=1.35 run=2 blk=0 avail=6821 (58.2%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=136 ap=21 tcp=22 topuser=tubesupplies 2026-08-15 04:24:01 L1=1.35 run=1 blk=0 avail=6925 (59.0%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=18 topuser=- 2026-08-15 04:24:09 L1=1.14 run=3 blk=0 avail=6885 (58.7%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=73 ap=20 tcp=25 topuser=madalice 2026-08-15 04:24:11 L1=1.14 run=1 blk=0 avail=6919 (59.0%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=23 topuser=- 2026-08-15 04:24:19 L1=1.20 run=1 blk=0 avail=6928 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=20 tcp=20 topuser=- 2026-08-15 04:24:21 L1=1.20 run=3 blk=0 avail=6921 (59.0%) swpO=0 conn=1 myRSS=2277 php=0 phpRSS=0 ap=20 tcp=23 topuser=- 2026-08-15 04:24:29 L1=1.57 run=2 blk=0 avail=6710 (57.2%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=144 ap=36 tcp=38 topuser=tubesupplies 2026-08-15 04:24:31 L1=1.57 run=3 blk=0 avail=6699 (57.1%) swpO=0 conn=1 myRSS=2277 php=1 phpRSS=150 ap=35 tcp=52 topuser=tubesupplies 2026-08-15 04:24:39 L1=2.53 run=10 blk=0 avail=6181 (52.7%) swpO=120 conn=2 myRSS=2274 php=9 phpRSS=894 ap=48 tcp=37 topuser=customc 2026-08-15 04:24:41 L1=2.53 run=2 blk=0 avail=6740 (57.5%) swpO=120 conn=1 myRSS=2274 php=1 phpRSS=89 ap=45 tcp=23 topuser=tubesupplies 2026-08-15 04:24:49 L1=3.49 run=2 blk=0 avail=6819 (58.1%) swpO=0 conn=2 myRSS=2274 php=0 phpRSS=0 ap=43 tcp=26 topuser=- 2026-08-15 04:24:51 L1=3.49 run=24 blk=0 avail=5375 (45.8%) swpO=0 conn=23 myRSS=2274 php=23 phpRSS=2193 ap=41 tcp=58 topuser=customc