INCIDENT 2026-08-15 07:07:17 trigger: php_procs=25 php_rss=2940MB mysql_conn=24 ================================================================== load: 3.23 19.09 16.44 29/682 2548812 ncpu:10 mem_avail: 6843MB/11729MB (58.3%) swap_used:1400MB swapout:0/s blocked(D):0 running:27 iowait:0.1% steal:0.0% php: 25 procs / 2940MB heaviest user: madalice (24 procs, 2701MB) apache: 82 procs tcp_estab: 68 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 24 2951 nobody 81 931 mysql 1 537 root 239 499 corpkicks 1 240 netdata 8 221 cpanellogin 1 41 mailnull 4 22 dovenull 6 20 mailman 20 19 wp-toolkit 6 18 zabbix 1 12 candyfabcom 1 12 kurri 3 7 dovecot 3 7 named 1 3 cpanelconnecttrack 1 3 evolution 4 2 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 24 2992 corpkicks 1 240 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3015 MB Active(file): 1057 MB Inactive(file): 535 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 189 MB CommitLimit: 9960 MB Committed_AS: 11887 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 05:56:02 208 /usr/bin/imunify-agent-proxy 2544311 root 07:15 0 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2544865 1 mysql 550532 4.5 Ssl 06:18 /usr/sbin/mariadbd 2548659 2547616 madalice 264740 55.7 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548673 2548664 corpkicks 245892 44.6 Rl 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2548716 2548677 madalice 203600 61.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548710 2547652 madalice 181416 53.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548723 2547617 madalice 177400 75.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548691 2548667 madalice 173092 50.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548708 2548675 madalice 167076 48.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 166676 2.5 Ssl 46-20:57:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2548717 2548678 madalice 150556 41.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548730 2548684 madalice 150548 62.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548722 2547654 madalice 147852 61.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548729 2548681 madalice 141012 57.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 138928 0.0 S 04:31:40 spamd child 2548724 2548679 madalice 137500 55.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548764 2547583 madalice 132724 52.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548714 2548676 madalice 132448 35.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548769 2548688 madalice 130856 50.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548725 2547614 madalice 121804 46.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548721 2547585 madalice 117356 45.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548767 2548631 madalice 106240 36.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548728 2548680 madalice 105552 35.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548765 2546847 madalice 103532 34.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548771 2547612 madalice 100512 67.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548777 2548649 madalice 98228 60.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 82984 0.0 Ss 04:44:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2548779 2547605 madalice 71820 27.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548780 2548639 madalice 70652 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2548794 2548640 madalice 69696 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 52772 0.0 Ss 25-21:20:28 /usr/lib/systemd/systemd-journald 2525318 1353308 cpanellogin 42372 0.0 S 39:05 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 4922 2431 netdata 42200 0.1 Sl 46-20:57:15 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2548840 1469 root 26032 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2390234 2382613 root 22324 0.0 S 04:31:40 spamd child 2223 1201 root 22320 0.0 Sl 46-20:57:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 21128 0.1 Ss 46-20:57:19 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2546847 1276780 nobody 20544 0.0 S 03:02 /usr/sbin/httpd -k start 2547585 1276780 nobody 20360 0.0 S 01:41 /usr/sbin/httpd -k start 2381704 1 root 19704 0.0 Ss 04:45:05 lfd - sleeping 2547605 1276780 nobody 19556 0.0 S 01:39 /usr/sbin/httpd -k start 2547617 1276780 nobody 19360 0.0 S 01:39 /usr/sbin/httpd -k start 2547652 1276780 nobody 18968 0.0 S 01:38 /usr/sbin/httpd -k start 2547612 1276780 nobody 18840 0.0 S 01:39 /usr/sbin/httpd -k start 2547552 1276780 nobody 18724 0.0 S 01:43 /usr/sbin/httpd -k start 2547630 1276780 nobody 18580 0.0 S 01:38 /usr/sbin/httpd -k start 2547616 1276780 nobody 18228 0.0 S 01:39 /usr/sbin/httpd -k start 2547614 1276780 nobody 18192 0.0 S 01:39 /usr/sbin/httpd -k start 2547611 1276780 nobody 18008 0.0 S 01:39 /usr/sbin/httpd -k start 2547583 1276780 nobody 17872 0.0 S 01:41 /usr/sbin/httpd -k start 2547654 1276780 nobody 17708 0.0 S 01:38 /usr/sbin/httpd -k start 2547615 1276780 nobody 17572 0.0 S 01:39 /usr/sbin/httpd -k start 2548631 1276780 nobody 17228 0.1 S 00:07 /usr/sbin/httpd -k start 2548648 1276780 nobody 17180 0.2 S 00:05 /usr/sbin/httpd -k start 2548650 1276780 nobody 17168 0.2 S 00:05 /usr/sbin/httpd -k start 2548640 1276780 nobody 17112 0.1 S 00:06 /usr/sbin/httpd -k start 2548647 1276780 nobody 17100 0.2 S 00:05 /usr/sbin/httpd -k start 2548689 1276780 nobody 17092 0.0 S 00:03 /usr/sbin/httpd -k start 2548639 1276780 nobody 17076 0.3 S 00:06 /usr/sbin/httpd -k start 2548660 1276780 nobody 16976 0.0 S 00:04 /usr/sbin/httpd -k start 2548682 1276780 nobody 16928 0.0 S 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 588 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 96 kurri/kurrimotorinn.com.au-ssl_log 39 customkidscom/customkids.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 25 otter2/otterfencing.net.au 12 vinesit/vinesit.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 3 alison/alisonarts.com.au 2 corpkicks/corporatekicks.com.au-ssl_log 2 speedlin/speedlinefencing.com.au-ssl_log 2 olytis/tis.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 58 74.248.133.44 56 34.48.140.215 26 74.248.115.87 25 203.54.180.238 12 172.161.0.2 7 62.60.130.247 6 118.127.40.55 5 216.244.66.240 2 91.92.243.248 2 51.68.107.154 2 45.162.199.215 2 200.8.108.154 2 187.189.242.191 2 186.218.16.45 2 181.116.248.202 --- top request paths across all vhosts (last 3 min) --- 25 GET /heartbeat.php 14 GET / 10 POST / 7 POST /wp-json/batch/v1 6 GET /robots.txt 4 GET /.git/HEAD 4 GET /.git/config 3 POST /wp-cron.php 3 GET /wp-admin/ 2 POST /wp-login.php 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-login.php 2 GET /workspace 2 GET /user/login 2 GET /signin 2 GET /settings 2 GET /rclone.conf 2 GET /profile 2 GET /product-tag/blue-nike-socks/ 2 GET /portal --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 11 GET / 8 POST / 7 POST /wp-json/batch/v1 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-login.php 2 GET /wp-admin/ 2 GET /workspace 2 GET /user/login 2 GET /signin 2 GET /settings 2 GET /rclone.conf 2 GET /profile -- last 10 requests -- 47.82.201.34 - - [15/Aug/2026:07:07:15 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/product-tag/groomsmen-gifts/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWe 105.99.64.30 - - [15/Aug/2026:07:07:15 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/product-tag/blue-nike-socks/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 47.82.201.5 - - [15/Aug/2026:07:07:15 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/product-tag/golf/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 43.119.100.76 - - [15/Aug/2026:07:07:16 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/tag/storm/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTM 181.116.248.202 - - [15/Aug/2026:07:07:16 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/product-tag/personalised-socks/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW 47.82.202.178 - - [15/Aug/2026:07:07:15 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/tag/nrl/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, 177.87.106.147 - - [15/Aug/2026:07:07:16 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/tag/storm/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, l 43.119.100.190 - - [15/Aug/2026:07:07:15 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/product-tag/tennis/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/53 45.162.199.215 - - [15/Aug/2026:07:07:16 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/tag/nrl/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, lik 187.189.242.191 - - [15/Aug/2026:07:07:16 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/product-tag/tennis/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /ws.php 1 GET /wp-sigunq.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/images/media/ 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/assets/index.php -- last 10 requests -- 74.248.133.44 - - [15/Aug/2026:07:07:17 +1000] "GET /mini.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:17 +1000] "GET /wp-content/themes/admin.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:17 +1000] "GET /classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:18 +1000] "GET /404.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:18 +1000] "GET /shell.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:19 +1000] "GET /wp-admin/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:19 +1000] "GET /file.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:19 +1000] "GET /222.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:20 +1000] "GET /wp-content/admin.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [15/Aug/2026:07:07:20 +1000] "GET /wp-admin/a.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == customkidscom/customkids.com.au-ssl_log == -- top paths -- 1 GET /z1.php 1 GET /xx.php 1 GET /wp-verb.php 1 GET /wp-editor.php 1 GET /wp-aa.php 1 GET /vl.php 1 GET /special.php 1 GET /min.php 1 GET /lock360.php 1 GET /Jcrop.php 1 GET /ioammdmu.php 1 GET /invisi.php -- last 10 requests -- 74.248.115.87 - - [15/Aug/2026:07:05:51 +1000] "GET /special.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:52 +1000] "GET /wp-aa.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:53 +1000] "GET /xx.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:53 +1000] "GET /byzz.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:54 +1000] "GET /ioammdmu.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:54 +1000] "GET /cmd.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:55 +1000] "GET /min.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:56 +1000] "GET /vl.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:56 +1000] "GET /2x.php HTTP/1.1" 404 5749 "-" "-" 74.248.115.87 - - [15/Aug/2026:07:05:57 +1000] "GET /z1.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 07:04:54 L1=4.88 run=2 blk=0 avail=9265 (79.0%) swpO=0 conn=3 myRSS=509 php=0 phpRSS=0 ap=29 tcp=21 topuser=- 2026-08-15 07:04:55 L1=4.88 run=1 blk=0 avail=9274 (79.1%) swpO=0 conn=7 myRSS=509 php=0 phpRSS=0 ap=28 tcp=21 topuser=- 2026-08-15 07:05:04 L1=4.13 run=1 blk=0 avail=9319 (79.4%) swpO=0 conn=1 myRSS=509 php=0 phpRSS=0 ap=20 tcp=20 topuser=- 2026-08-15 07:05:05 L1=4.13 run=2 blk=0 avail=9328 (79.5%) swpO=0 conn=7 myRSS=509 php=0 phpRSS=0 ap=20 tcp=20 topuser=- 2026-08-15 07:05:14 L1=3.57 run=1 blk=0 avail=9337 (79.6%) swpO=0 conn=1 myRSS=509 php=0 phpRSS=0 ap=17 tcp=26 topuser=- 2026-08-15 07:05:15 L1=3.57 run=1 blk=1 avail=9336 (79.6%) swpO=0 conn=1 myRSS=509 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-15 07:05:24 L1=3.02 run=1 blk=0 avail=9346 (79.7%) swpO=0 conn=1 myRSS=510 php=0 phpRSS=0 ap=17 tcp=18 topuser=- 2026-08-15 07:05:25 L1=3.02 run=2 blk=0 avail=9346 (79.7%) swpO=0 conn=1 myRSS=510 php=0 phpRSS=0 ap=17 tcp=19 topuser=- 2026-08-15 07:05:34 L1=3.27 run=7 blk=0 avail=8848 (75.4%) swpO=0 conn=1 myRSS=511 php=8 phpRSS=729 ap=17 tcp=38 topuser=madalice 2026-08-15 07:05:35 L1=3.27 run=8 blk=0 avail=8422 (71.8%) swpO=0 conn=1 myRSS=511 php=8 phpRSS=1157 ap=18 tcp=36 topuser=madalice 2026-08-15 07:05:44 L1=4.84 run=20 blk=0 avail=7824 (66.7%) swpO=0 conn=1 myRSS=512 php=11 phpRSS=1454 ap=77 tcp=68 topuser=madalice 2026-08-15 07:05:45 L1=4.84 run=18 blk=0 avail=7026 (59.9%) swpO=0 conn=17 myRSS=512 php=16 phpRSS=2242 ap=76 tcp=70 topuser=madalice 2026-08-15 07:05:54 L1=5.77 run=9 blk=0 avail=8077 (68.9%) swpO=0 conn=1 myRSS=514 php=8 phpRSS=1161 ap=69 tcp=69 topuser=madalice 2026-08-15 07:05:57 L1=5.77 run=1 blk=0 avail=8771 (74.8%) swpO=0 conn=17 myRSS=515 php=1 phpRSS=258 ap=67 tcp=47 topuser=madalice 2026-08-15 07:06:04 L1=4.95 run=1 blk=0 avail=9042 (77.1%) swpO=0 conn=1 myRSS=515 php=0 phpRSS=0 ap=60 tcp=21 topuser=- 2026-08-15 07:06:07 L1=4.95 run=2 blk=0 avail=8938 (76.2%) swpO=0 conn=17 myRSS=515 php=1 phpRSS=156 ap=57 tcp=21 topuser=madalice 2026-08-15 07:06:15 L1=4.34 run=1 blk=0 avail=9117 (77.7%) swpO=0 conn=1 myRSS=515 php=0 phpRSS=0 ap=49 tcp=22 topuser=- 2026-08-15 07:06:17 L1=4.34 run=1 blk=0 avail=9131 (77.9%) swpO=0 conn=1 myRSS=515 php=0 phpRSS=0 ap=47 tcp=23 topuser=- 2026-08-15 07:06:25 L1=3.68 run=1 blk=0 avail=9188 (78.3%) swpO=0 conn=1 myRSS=515 php=0 phpRSS=0 ap=39 tcp=20 topuser=- 2026-08-15 07:06:27 L1=3.68 run=2 blk=0 avail=9203 (78.5%) swpO=0 conn=1 myRSS=515 php=0 phpRSS=0 ap=37 tcp=20 topuser=- 2026-08-15 07:06:35 L1=3.11 run=3 blk=0 avail=9184 (78.3%) swpO=0 conn=1 myRSS=515 php=1 phpRSS=100 ap=29 tcp=21 topuser=speedlin 2026-08-15 07:06:37 L1=3.11 run=1 blk=0 avail=9269 (79.0%) swpO=0 conn=1 myRSS=515 php=0 phpRSS=0 ap=27 tcp=23 topuser=- 2026-08-15 07:06:45 L1=2.86 run=2 blk=0 avail=9281 (79.1%) swpO=0 conn=1 myRSS=515 php=1 phpRSS=70 ap=20 tcp=22 topuser=madalice 2026-08-15 07:06:47 L1=2.86 run=1 blk=0 avail=9321 (79.5%) swpO=0 conn=1 myRSS=515 php=0 phpRSS=0 ap=19 tcp=24 topuser=- 2026-08-15 07:06:55 L1=2.57 run=2 blk=0 avail=9183 (78.3%) swpO=0 conn=1 myRSS=515 php=1 phpRSS=169 ap=19 tcp=24 topuser=madalice 2026-08-15 07:06:57 L1=2.57 run=5 blk=0 avail=9201 (78.4%) swpO=0 conn=1 myRSS=515 php=4 phpRSS=242 ap=19 tcp=29 topuser=speedlin 2026-08-15 07:07:05 L1=2.40 run=4 blk=0 avail=9151 (78.0%) swpO=0 conn=3 myRSS=526 php=2 phpRSS=218 ap=19 tcp=24 topuser=evolution 2026-08-15 07:07:07 L1=2.40 run=2 blk=0 avail=9017 (76.9%) swpO=0 conn=1 myRSS=532 php=2 phpRSS=345 ap=19 tcp=27 topuser=evolution 2026-08-15 07:07:15 L1=3.23 run=8 blk=0 avail=7974 (68.0%) swpO=0 conn=3 myRSS=533 php=9 phpRSS=1401 ap=50 tcp=55 topuser=madalice 2026-08-15 07:07:17 L1=3.23 run=27 blk=0 avail=6843 (58.3%) swpO=0 conn=24 myRSS=536 php=25 phpRSS=2940 ap=82 tcp=68 topuser=madalice