INCIDENT 2026-08-15 06:55:11 trigger: php_rss=1804MB ================================================================== load: 1.29 0.69 0.67 17/629 2541355 ncpu:10 mem_avail: 5365MB/11729MB (45.7%) swap_used:1156MB swapout:0/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 11 procs / 1804MB heaviest user: madalice (8 procs, 1418MB) apache: 38 procs tcp_estab: 80 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2294 madalice 7 1061 root 237 918 nobody 41 609 netdata 8 268 corpkicks 1 237 otterfencing 1 113 cpanellogin 1 64 evolution 5 51 kurri 4 50 dovenull 6 28 lowrange 2 26 infinium 2 25 wp-toolkit 6 20 mailman 20 14 zabbix 1 11 dovecot 3 8 named 1 7 nscd 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 7 978 corpkicks 1 237 otterfencing 1 114 evolution 1 57 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4259 MB Active(file): 3499 MB Inactive(file): 620 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 506 MB CommitLimit: 9960 MB Committed_AS: 8385 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 05:43:56 5296 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 2349568 10.1 Ssl 1-05:16:11 /usr/sbin/mariadbd 2541299 2540940 corpkicks 242992 61.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 218060 2.5 Ssl 46-20:45:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2541296 2538210 madalice 213996 98.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 186456 0.0 S 04:19:34 spamd child 2382613 1 root 174164 0.0 Ss 04:32:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2541300 2540690 madalice 165220 72.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390234 2382613 root 158524 0.0 S 04:19:34 spamd child 2541302 2541297 madalice 149464 59.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2541310 2540145 otterfencing 122644 101 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2541313 2541309 madalice 106516 72.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 102544 0.0 Ss 25-21:08:22 /usr/lib/systemd/systemd-journald 2541314 2541308 madalice 94104 54.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2541320 2540691 evolution 69700 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2525318 1353308 cpanellogin 65664 0.1 S 26:59 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2223 1201 root 54040 0.0 Sl 46-20:45:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 41908 0.1 Ss 46-20:45:13 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41856 0.0 Ss 24-04:13:44 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33668 0.1 Sl 46-20:45:09 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2381704 1 root 32376 0.0 Ss 04:32:59 lfd - sleeping 2541280 2540710 madalice 28676 75.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2534347 1276780 nobody 21968 0.0 S 12:18 /usr/sbin/httpd -k start 2535265 1276780 nobody 21940 0.0 S 10:31 /usr/sbin/httpd -k start 2528164 1276780 nobody 21720 0.0 S 21:34 /usr/sbin/httpd -k start 2538210 1276780 nobody 19512 0.0 S 04:53 /usr/sbin/httpd -k start 2539105 1276780 nobody 18872 0.0 S 03:17 /usr/sbin/httpd -k start 2540145 1276780 nobody 18544 0.0 S 01:50 /usr/sbin/httpd -k start 2540678 1276780 nobody 18500 0.1 S 00:34 /usr/sbin/httpd -k start 2539167 1276780 nobody 18492 0.0 S 03:14 /usr/sbin/httpd -k start 2540119 1276780 nobody 18440 0.0 S 01:51 /usr/sbin/httpd -k start 2540147 1276780 nobody 18384 0.1 S 01:50 /usr/sbin/httpd -k start 2538217 1276780 nobody 18212 0.0 S 04:52 /usr/sbin/httpd -k start 2540146 1276780 nobody 17740 0.0 S 01:50 /usr/sbin/httpd -k start 2539185 1276780 nobody 17644 0.0 S 03:14 /usr/sbin/httpd -k start 2540710 1276780 nobody 17640 0.0 S 00:32 /usr/sbin/httpd -k start 2540677 1276780 nobody 17564 0.0 S 00:34 /usr/sbin/httpd -k start 2540008 1276780 nobody 17504 0.0 S 02:01 /usr/sbin/httpd -k start 2540705 1276780 nobody 17420 0.1 S 00:32 /usr/sbin/httpd -k start 2540708 1276780 nobody 17332 0.0 S 00:32 /usr/sbin/httpd -k start 2540667 1276780 nobody 16908 0.0 S 00:35 /usr/sbin/httpd -k start 2539168 1276780 nobody 16512 0.0 S 03:14 /usr/sbin/httpd -k start 2540691 1276780 nobody 16440 0.0 S 00:33 /usr/sbin/httpd -k start 2539124 1276780 nobody 15988 0.0 S 03:16 /usr/sbin/httpd -k start 2539073 1276780 nobody 15944 0.0 S 03:18 /usr/sbin/httpd -k start 2540706 1276780 nobody 15844 0.0 S 00:32 /usr/sbin/httpd -k start 2540940 1276780 nobody 15836 0.0 S 00:16 /usr/sbin/httpd -k start 2539122 1276780 nobody 15572 0.0 S 03:16 /usr/sbin/httpd -k start 2540707 1276780 nobody 15440 0.0 S 00:32 /usr/sbin/httpd -k start 2540692 1276780 nobody 15428 0.1 S 00:33 /usr/sbin/httpd -k start 2541297 1276780 nobody 15112 0.0 S 00:02 /usr/sbin/httpd -k start 2541309 1276780 nobody 14996 0.0 S 00:01 /usr/sbin/httpd -k start 2540690 1276780 nobody 14992 0.0 S 00:33 /usr/sbin/httpd -k start 2541308 1276780 nobody 14992 0.0 S 00:01 /usr/sbin/httpd -k start 185104 2431 netdata 14944 2.0 Sl 2-10:21:32 /usr/libexec/netdata/plugins.d/apps.plugin 1 2539175 1276780 nobody 14940 0.0 S 03:14 /usr/sbin/httpd -k start 1601939 1471 root 14492 0.0 S 23:42:14 cPhulkd - dbprocessor 2540574 3828812 lowrange 14356 0.1 S 00:43 dovecot/pop3 1463 1 root 14244 0.0 Ss 46-20:45:13 tailwatchd 2539187 1276780 nobody 13920 0.0 S 03:14 /usr/sbin/httpd -k start 2514007 3828812 infinium 13312 0.0 S 46:47 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4012420 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au 97 olytis/tis.com.au-ssl_log 87 kamcool/kamcool.com.au-ssl_log 43 tubesupplies/tubesupplies.com.au-ssl_log 35 vinesit/westpanel.vinesit.com.au-ssl_log 28 vinesit/westpanel.vinesit.com.au 27 evolution/portal.evolutionerp.com.au-ssl_log 17 madalice/madalice.com.au-ssl_log 11 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 130 20.163.43.14 97 45.148.10.238 55 20.228.229.148 35 20.80.111.3 17 203.54.180.238 2 68.67.112.173 1 98.97.147.143 1 52.0.41.164 1 220.181.108.145 1 207.46.13.51 1 190.60.46.6 1 117.201.18.205 1 116.179.37.60 1 116.179.37.201 1 103.111.34.190 --- top request paths across all vhosts (last 3 min) --- 17 GET /heartbeat.php 6 GET / 5 POST / 4 GET /.env.swp 4 GET /.env.dev 4 GET /env 4 GET /aa.php 4 GET /404.php 3 GET /wp-content/admin.php 3 GET /wp-admin/js/ 3 GET /moon.php 3 GET /.env.staging 3 GET /.env.server 3 GET /.env.save 3 GET /.env.php 3 GET /.env.old 3 GET /.env.backup 3 GET /.env~ 3 GET /admin.php 3 GET /adminfuns.php --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au == -- top paths -- 4 POST / 4 GET /.env.swp 4 GET /.env.dev 4 GET /env 4 GET / 3 GET /.env.staging 3 GET /.env.server 3 GET /.env.save 3 GET /.env.php 3 GET /.env.old 3 GET /.env.backup 3 GET /.env~ -- last 10 requests -- 45.148.10.238 - - [15/Aug/2026:06:54:44 +1000] "GET /.%65%6e%76?v=qGQJg HTTP/1.1" 403 12 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.311 45.148.10.238 - - [15/Aug/2026:06:54:44 +1000] "GET /.%65%6e%76%7e?v=0xu0m HTTP/1.1" 404 - "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3 45.148.10.238 - - [15/Aug/2026:06:54:45 +1000] "GET /%2eenv%2eserver?v=vU2E2 HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36" 45.148.10.238 - - [15/Aug/2026:06:54:45 +1000] "GET /.%65%6e%76.%73%65%72%76%65%72?v=vU2E2 HTTP/1.1" 403 12 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18. 45.148.10.238 - - [15/Aug/2026:06:54:45 +1000] "GET /.env.dev?v=yHBr3 HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15" 45.148.10.238 - - [15/Aug/2026:06:54:45 +1000] "GET /env?v=Q92B4 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0" 45.148.10.238 - - [15/Aug/2026:06:54:46 +1000] "POST / HTTP/1.1" 200 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.238 - - [15/Aug/2026:06:54:50 +1000] "GET /%00.env HTTP/1.1" 404 - "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie 45.148.10.238 - - [15/Aug/2026:06:54:50 +1000] "GET /.%65%6e%76.%62%61%63%6b%75%70?v=8a8Xv HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Saf 45.148.10.238 - - [15/Aug/2026:06:54:51 +1000] "GET /%2eenv%2ev1?v=mCqtn HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == olytis/tis.com.au-ssl_log == -- top paths -- 1 GET /zxz.php 1 GET /xmlrpc.php 1 GET /www.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/js/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/ID3/ -- last 10 requests -- 20.163.43.14 - - [15/Aug/2026:06:54:55 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:55 +1000] "GET /tes.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:56 +1000] "GET /files/index.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:56 +1000] "GET /images/images/about.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:57 +1000] "GET /ms-edit.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:57 +1000] "GET /rip.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:57 +1000] "GET /wp-content/uploads/ HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:57 +1000] "GET /xmlrpc.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:58 +1000] "GET /moon.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:54:58 +1000] "GET /cache.php HTTP/1.1" 401 36 "-" "-" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 1 GET /zxz.php 1 GET /www.php 1 GET /wp-includes/js/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/html-api/ 1 GET /wp-includes/block-supports/ 1 GET /wp-includes/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content.php.php 1 GET /wp-content/cache/ 1 GET /wp-content/admin.php -- last 10 requests -- 20.163.43.14 - - [15/Aug/2026:06:55:07 +1000] "GET /wp-admin/js/ HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:07 +1000] "GET /403.php HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:08 +1000] "GET /wp-includes/images/ HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:08 +1000] "GET /wp-content/cache/ HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:08 +1000] "GET /gecko.php HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:09 +1000] "GET /wp-includes/ HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:09 +1000] "GET /aa.php HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:09 +1000] "GET /0x.php HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:10 +1000] "GET /zxz.php HTTP/1.1" 404 5749 "-" "-" 20.163.43.14 - - [15/Aug/2026:06:55:10 +1000] "GET /www.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 06:52:44 L1=0.48 run=2 blk=0 avail=6839 (58.3%) swpO=0 conn=2 myRSS=2294 php=2 phpRSS=97 ap=37 tcp=26 topuser=alison 2026-08-15 06:52:51 L1=0.56 run=1 blk=0 avail=6913 (58.9%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=31 tcp=29 topuser=- 2026-08-15 06:52:54 L1=0.56 run=2 blk=0 avail=6494 (55.4%) swpO=0 conn=2 myRSS=2294 php=3 phpRSS=522 ap=28 tcp=30 topuser=corpkicks 2026-08-15 06:53:01 L1=0.62 run=1 blk=0 avail=6954 (59.3%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=24 tcp=29 topuser=- 2026-08-15 06:53:04 L1=0.57 run=1 blk=0 avail=6938 (59.2%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=40 ap=24 tcp=29 topuser=evolution 2026-08-15 06:53:11 L1=0.53 run=3 blk=0 avail=6593 (56.2%) swpO=0 conn=1 myRSS=2294 php=2 phpRSS=412 ap=26 tcp=34 topuser=corpkicks 2026-08-15 06:53:14 L1=0.48 run=1 blk=0 avail=6932 (59.1%) swpO=0 conn=2 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=31 topuser=- 2026-08-15 06:53:21 L1=0.53 run=4 blk=0 avail=6610 (56.4%) swpO=0 conn=1 myRSS=2294 php=2 phpRSS=158 ap=30 tcp=37 topuser=madalice 2026-08-15 06:53:24 L1=0.48 run=1 blk=0 avail=6886 (58.7%) swpO=2 conn=2 myRSS=2294 php=1 phpRSS=24 ap=34 tcp=44 topuser=madalice 2026-08-15 06:53:31 L1=0.44 run=1 blk=0 avail=6894 (58.8%) swpO=2 conn=1 myRSS=2294 php=0 phpRSS=0 ap=33 tcp=35 topuser=- 2026-08-15 06:53:34 L1=0.49 run=2 blk=0 avail=6697 (57.1%) swpO=0 conn=2 myRSS=2294 php=2 phpRSS=265 ap=31 tcp=36 topuser=customc 2026-08-15 06:53:41 L1=0.45 run=1 blk=0 avail=6920 (59.0%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=28 tcp=31 topuser=- 2026-08-15 06:53:44 L1=0.41 run=1 blk=0 avail=6940 (59.2%) swpO=0 conn=2 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=29 topuser=- 2026-08-15 06:53:51 L1=0.38 run=1 blk=0 avail=6934 (59.1%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=35 topuser=- 2026-08-15 06:53:54 L1=0.35 run=2 blk=0 avail=6935 (59.1%) swpO=0 conn=2 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=33 topuser=- 2026-08-15 06:54:01 L1=0.32 run=1 blk=0 avail=6936 (59.1%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=30 topuser=- 2026-08-15 06:54:04 L1=0.29 run=2 blk=0 avail=6936 (59.1%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=30 topuser=- 2026-08-15 06:54:11 L1=0.27 run=1 blk=0 avail=6940 (59.2%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=31 topuser=- 2026-08-15 06:54:14 L1=0.25 run=2 blk=0 avail=6940 (59.2%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=29 topuser=- 2026-08-15 06:54:21 L1=0.23 run=1 blk=0 avail=6945 (59.2%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=26 tcp=31 topuser=- 2026-08-15 06:54:24 L1=0.29 run=2 blk=0 avail=6782 (57.8%) swpO=0 conn=1 myRSS=2294 php=2 phpRSS=220 ap=26 tcp=35 topuser=otterfencing 2026-08-15 06:54:31 L1=0.35 run=2 blk=0 avail=6918 (59.0%) swpO=1 conn=1 myRSS=2294 php=1 phpRSS=41 ap=27 tcp=35 topuser=otterfencing 2026-08-15 06:54:34 L1=0.40 run=3 blk=0 avail=6801 (58.0%) swpO=1 conn=1 myRSS=2294 php=1 phpRSS=152 ap=27 tcp=35 topuser=otterfencing 2026-08-15 06:54:41 L1=0.37 run=1 blk=0 avail=6818 (58.1%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=42 tcp=47 topuser=- 2026-08-15 06:54:44 L1=0.42 run=2 blk=0 avail=6757 (57.6%) swpO=0 conn=1 myRSS=2294 php=1 phpRSS=96 ap=42 tcp=41 topuser=otterfencing 2026-08-15 06:54:51 L1=0.55 run=2 blk=0 avail=6780 (57.8%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=105 ap=37 tcp=43 topuser=otterfencing 2026-08-15 06:54:54 L1=0.58 run=2 blk=0 avail=6854 (58.4%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=36 tcp=46 topuser=- 2026-08-15 06:55:01 L1=0.78 run=1 blk=0 avail=6847 (58.4%) swpO=0 conn=2 myRSS=2294 php=0 phpRSS=0 ap=37 tcp=43 topuser=- 2026-08-15 06:55:04 L1=0.79 run=2 blk=0 avail=6769 (57.7%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=118 ap=37 tcp=41 topuser=otterfencing 2026-08-15 06:55:11 L1=1.29 run=12 blk=0 avail=5365 (45.7%) swpO=0 conn=11 myRSS=2294 php=11 phpRSS=1804 ap=38 tcp=80 topuser=madalice