INCIDENT 2026-08-15 07:11:16 trigger: mysql_conn=39 ================================================================== load: 6.35 11.35 13.77 2/632 2551869 ncpu:10 mem_avail: 9031MB/11729MB (77.0%) swap_used:1327MB swapout:0/s blocked(D):0 running:1 iowait:0.0% steal:0.0% php: 1 procs / 40MB heaviest user: evolution (1 procs, 40MB) apache: 42 procs tcp_estab: 22 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 41 666 mysql 1 563 root 238 539 netdata 8 227 cpanellogin 1 89 evolution 5 43 dovenull 6 20 mailman 20 19 wp-toolkit 6 18 zabbix 1 12 kurri 3 7 dovecot 3 7 mailnull 2 6 named 1 4 cpanelconnecttrack 1 3 polkitd 1 2 dbus 1 2 nscd 1 1 rpc 1 0 chrony 1 0 --- php workers by user --- USER PROCS RSS_MB evolution 1 40 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2239 MB Active(file): 1249 MB Inactive(file): 1119 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 210 MB CommitLimit: 9960 MB Committed_AS: 7048 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 06:00:00 208 /usr/bin/imunify-agent-proxy 2550360 root 02:01 61084 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2544865 1 mysql 576848 4.6 Ssl 10:17 /usr/sbin/mariadbd 1220 1 netdata 172052 2.5 Ssl 46-21:01:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2390233 2382613 root 138928 0.0 S 04:35:39 spamd child 2525318 1353308 cpanellogin 91144 0.0 S 43:04 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2382613 1 root 82984 0.0 Ss 04:48:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2550360 1 root 61084 1.1 Ssl 02:02 /opt/imunify360/venv/bin/python3 -m imav.run 159820 1 root 59160 0.0 Ss 25-21:24:27 /usr/lib/systemd/systemd-journald 4922 2431 netdata 42392 0.1 Sl 46-21:01:14 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2551844 2551277 evolution 41864 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 26416 0.0 Sl 46-21:01:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2390234 2382613 root 22324 0.0 S 04:35:39 spamd child 1469 1 root 21132 0.1 Ss 46-21:01:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2548751 1276780 nobody 20248 0.0 S 04:01 /usr/sbin/httpd -k start 2548676 1276780 nobody 19844 0.0 S 04:02 /usr/sbin/httpd -k start 2381704 1 root 19748 0.0 Ss 04:49:04 lfd - sleeping 2551003 1276780 nobody 18896 0.0 S 01:05 /usr/sbin/httpd -k start 2551002 1276780 nobody 18692 0.0 S 01:05 /usr/sbin/httpd -k start 2551024 1276780 nobody 18672 0.0 S 01:04 /usr/sbin/httpd -k start 2550990 1276780 nobody 18652 0.0 S 01:06 /usr/sbin/httpd -k start 2551017 1276780 nobody 18652 0.0 S 01:04 /usr/sbin/httpd -k start 2551027 1276780 nobody 18640 0.0 S 01:04 /usr/sbin/httpd -k start 2550999 1276780 nobody 18632 0.0 S 01:05 /usr/sbin/httpd -k start 2550991 1276780 nobody 18596 0.0 S 01:06 /usr/sbin/httpd -k start 2550998 1276780 nobody 18492 0.0 S 01:05 /usr/sbin/httpd -k start 2550045 1276780 nobody 18464 0.0 S 02:34 /usr/sbin/httpd -k start 2551028 1276780 nobody 18388 0.0 S 01:04 /usr/sbin/httpd -k start 2551001 1276780 nobody 18352 0.0 S 01:05 /usr/sbin/httpd -k start 2551015 1276780 nobody 18336 0.0 S 01:04 /usr/sbin/httpd -k start 2551341 1276780 nobody 18308 0.0 S 00:57 /usr/sbin/httpd -k start 2551018 1276780 nobody 18280 0.0 S 01:04 /usr/sbin/httpd -k start 2551369 1276780 nobody 18268 0.0 S 00:56 /usr/sbin/httpd -k start 2551206 1276780 nobody 18232 0.0 S 01:00 /usr/sbin/httpd -k start 2551207 1276780 nobody 18232 0.0 S 01:00 /usr/sbin/httpd -k start 2551019 1276780 nobody 18208 0.0 S 01:04 /usr/sbin/httpd -k start 2551278 1276780 nobody 18120 0.0 S 00:59 /usr/sbin/httpd -k start 2550592 1276780 nobody 17928 0.0 S 01:49 /usr/sbin/httpd -k start 2551354 1276780 nobody 17472 0.0 S 00:56 /usr/sbin/httpd -k start 2551021 1276780 nobody 17416 0.0 S 01:04 /usr/sbin/httpd -k start 2551023 1276780 nobody 17332 0.0 S 01:04 /usr/sbin/httpd -k start 2551277 1276780 nobody 17236 0.0 S 00:59 /usr/sbin/httpd -k start 2551363 1276780 nobody 17116 0.0 S 00:56 /usr/sbin/httpd -k start 2551477 1276780 nobody 16980 0.0 S 00:50 /usr/sbin/httpd -k start 2551360 1276780 nobody 16912 0.0 S 00:56 /usr/sbin/httpd -k start 2551105 1276780 nobody 16908 0.0 S 01:01 /usr/sbin/httpd -k start 2551437 1276780 nobody 16724 0.0 S 00:51 /usr/sbin/httpd -k start 2551440 1276780 nobody 16696 0.0 S 00:51 /usr/sbin/httpd -k start 2551414 1276780 nobody 16576 0.0 S 00:52 /usr/sbin/httpd -k start 2551280 1276780 nobody 16564 0.0 S 00:59 /usr/sbin/httpd -k start 2551357 1276780 nobody 16540 0.0 S 00:56 /usr/sbin/httpd -k start 2551480 1276780 nobody 16428 0.0 S 00:50 /usr/sbin/httpd -k start 185104 2431 netdata 16136 2.0 Sl 2-10:37:37 /usr/libexec/netdata/plugins.d/apps.plugin 1 2550989 1276780 nobody 14916 0.0 S 01:06 /usr/sbin/httpd -k start 1204 1 zabbix 12876 0.2 Ssl 46-21:01:19 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 11516 0.0 Ss 46-21:01:18 tailwatchd 2550911 3828812 root 11100 0.0 S 01:13 dovecot/auth -w 1601939 1471 root 10968 0.0 S 23:58:19 cPhulkd - dbprocessor 2551837 1471 root 10660 0.0 S 00:05 cPhulkd - processor - http socket 1059102 3828812 dovenull 7644 0.0 S 1-15:38:24 dovecot/imap-login 1059098 3828812 dovenull 7296 0.0 S 1-15:38:24 dovecot/imap-login 3651102 1 root 6844 0.0 Ss 7-04:48:32 queueprocd - waiting up to 60s to process a task --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 934 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 108 tubesupplies/tubesupplies.com.au-ssl_log 35 whiz/whizengineering.com.au-ssl_log 29 evolution/portal.evolutionerp.com.au-ssl_log 25 evolution/my.evolutionerp.com.au-ssl_log 10 customc/customcentral.com.au-ssl_log 9 speedlin/speedlinefencing.com.au-ssl_log 6 alison/alisonarts.com.au-ssl_log 3 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 35 20.104.49.167 29 20.110.140.87 25 203.54.180.238 8 143.244.57.118 4 65.21.136.254 4 157.55.39.58 2 93.34.235.74 2 91.109.163.141 2 91.106.41.141 2 84.54.70.111 2 81.196.154.48 2 72.255.7.212 2 68.67.112.216 2 59.152.97.165 2 47.82.201.66 --- top request paths across all vhosts (last 3 min) --- 66 GET / 32 POST / 25 GET /heartbeat.php 8 GET /index.php 2 GET /store/custom-wests-tigers-hand-painted-shoes/ 2 GET /sitemap_index.xml 2 GET /robots.txt 2 GET /oxvrws.php 2 GET // 1 POST /wp-cron.php 1 POST /functions.php 1 GET /xx.php 1 GET //xmlrpc.php 1 GET //wp-json/wp/v2/users/ 1 GET //wp-json/oembed/1.0/embed 1 GET //wp-includes/wlwmanifest.xml 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /.well-known/trust.txt 1 GET /we-customise-shoes-australia/ 1 GET /uplozyu.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 35 GET / 32 POST / 2 GET /store/custom-wests-tigers-hand-painted-shoes/ 1 GET /we-customise-shoes-australia/ 1 GET /the-ultimate-guide-to-sneaker-care-how-to-keep-your-custom-kicks-looking-fresh/ 1 GET /store/pink-pearl-bauble-af1/ 1 GET /store/pink-nike-crystal-sneakers/ 1 GET /store/nike-af1-ice-cream-sneakers-with-sprinkles/ 1 GET /store/leopard-luxe-adidas-samba-sneakers/ 1 GET /store/kids-af1-sequin-rainbow/ 1 GET /store/hand-painted-nike-af1-afl-melbourne/ 1 GET /store/custom-nike-air-force-1-mad-hatter-alice-in-wonderland/ -- last 10 requests -- 196.210.155.89 - - [15/Aug/2026:07:10:34 +1000] "GET /baby-yoda-custom-shoes/ HTTP/1.1" 200 30928 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 47.82.202.159 - - [15/Aug/2026:07:10:41 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/custom-shoe-options/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/53 103.103.125.82 - - [15/Aug/2026:07:10:41 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/custom-shoe-options/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 47.82.202.146 - - [15/Aug/2026:07:10:42 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/kids-custom-shoes-australia/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW 138.255.26.233 - - [15/Aug/2026:07:10:44 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/kids-custom-shoes-australia/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi 43.119.100.207 - - [15/Aug/2026:07:10:44 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/custom-ice-cream-sneakers-3d-waffle-cone-sprinkles/" "Mozilla/5.0 (Macintosh; 47.82.201.222 - - [15/Aug/2026:07:10:46 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/baby-yoda-custom-shoes/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit 102.217.249.217 - - [15/Aug/2026:07:10:46 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/custom-ice-cream-sneakers-3d-waffle-cone-sprinkles/" "Mozilla/5.0 (Macintosh; Inte 86.41.100.126 - - [15/Aug/2026:07:10:49 +1000] "GET /store/custom-wests-tigers-hand-painted-shoes/?utm_source=chatgpt.com HTTP/1.1" 404 30562 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML 216.73.216.26 - - [15/Aug/2026:07:10:50 +1000] "GET /store/hand-painted-nike-af1-afl-melbourne/ HTTP/1.1" 301 1 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /oxvrws.php 1 GET /xx.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /uplozyu.php 1 GET /uploxe.php 1 GET /uploat.php 1 GET /this_is_a_new_hello_world.php 1 GET /system.php 1 GET /sts.php 1 GET /shell20211028.php 1 GET /sf.php 1 GET /QtJwDSjqvyT.php -- last 10 requests -- 20.104.49.167 - - [15/Aug/2026:07:09:20 +1000] "GET /uplozyu.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:20 +1000] "GET /uploxe.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:21 +1000] "GET /shell20211028.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:21 +1000] "GET /dropdown.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:22 +1000] "GET /oxvrws.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:22 +1000] "GET /uploat.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:22 +1000] "GET /oxvrws.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:23 +1000] "GET /sts.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:23 +1000] "GET /system.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:24 +1000] "GET /layout.php HTTP/1.1" 404 5750 "-" "-" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 29 GET / -- last 10 requests -- 20.110.140.87 - - [15/Aug/2026:07:10:21 +1000] "GET /?locale=pl HTTP/1.1" 200 12765 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:22 +1000] "GET /?locale=ms HTTP/1.1" 200 12587 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:22 +1000] "GET /?locale=ko HTTP/1.1" 200 12777 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:25 +1000] "GET /?locale=pt HTTP/1.1" 200 12503 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:26 +1000] "GET /?locale=ro HTTP/1.1" 200 12630 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:30 +1000] "GET /?locale=sv HTTP/1.1" 200 12603 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:30 +1000] "GET /?locale=ru HTTP/1.1" 200 12956 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:32 +1000] "GET /?locale=tr HTTP/1.1" 200 12723 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 20.110.140.87 - - [15/Aug/2026:07:10:36 +1000] "GET /?locale=pt_br HTTP/1.1" 200 12609 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 20.110.140.87 - - [15/Aug/2026:07:10:38 +1000] "GET /?locale=th HTTP/1.1" 200 12874 "https://webmail.whizengineering.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 --- last 30 samples (run-up to this incident) --- 2026-08-15 07:08:45 L1=1.98 run=1 blk=0 avail=9320 (79.5%) swpO=0 conn=1 myRSS=544 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-15 07:08:54 L1=1.67 run=1 blk=0 avail=9315 (79.4%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=17 tcp=18 topuser=- 2026-08-15 07:08:55 L1=1.67 run=1 blk=0 avail=9316 (79.4%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-15 07:09:04 L1=1.50 run=2 blk=1 avail=9196 (78.4%) swpO=0 conn=1 myRSS=545 php=1 phpRSS=61 ap=20 tcp=19 topuser=alison 2026-08-15 07:09:05 L1=1.50 run=3 blk=1 avail=9115 (77.7%) swpO=0 conn=3 myRSS=545 php=2 phpRSS=176 ap=20 tcp=20 topuser=alison 2026-08-15 07:09:15 L1=1.57 run=2 blk=0 avail=9193 (78.4%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=25 tcp=20 topuser=- 2026-08-15 07:09:15 L1=1.57 run=2 blk=0 avail=9187 (78.3%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=24 tcp=22 topuser=evolution 2026-08-15 07:09:25 L1=1.40 run=1 blk=0 avail=9261 (79.0%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-15 07:09:25 L1=1.40 run=1 blk=0 avail=9255 (78.9%) swpO=0 conn=3 myRSS=545 php=2 phpRSS=54 ap=18 tcp=24 topuser=evolution 2026-08-15 07:09:35 L1=1.19 run=1 blk=0 avail=9236 (78.7%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=24 tcp=19 topuser=- 2026-08-15 07:09:35 L1=1.19 run=2 blk=0 avail=9231 (78.7%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=23 tcp=20 topuser=evolution 2026-08-15 07:09:45 L1=1.01 run=1 blk=0 avail=9259 (78.9%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=20 tcp=16 topuser=- 2026-08-15 07:09:45 L1=1.01 run=1 blk=0 avail=9252 (78.9%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=20 tcp=19 topuser=evolution 2026-08-15 07:09:55 L1=0.85 run=1 blk=0 avail=9273 (79.1%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=18 tcp=17 topuser=- 2026-08-15 07:09:56 L1=0.85 run=2 blk=0 avail=9261 (79.0%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=17 tcp=20 topuser=evolution 2026-08-15 07:10:05 L1=0.88 run=2 blk=0 avail=9164 (78.1%) swpO=0 conn=1 myRSS=545 php=1 phpRSS=131 ap=17 tcp=18 topuser=madalice 2026-08-15 07:10:06 L1=0.88 run=2 blk=0 avail=9078 (77.4%) swpO=0 conn=3 myRSS=545 php=2 phpRSS=245 ap=17 tcp=18 topuser=madalice 2026-08-15 07:10:15 L1=2.38 run=15 blk=0 avail=7855 (67.0%) swpO=0 conn=1 myRSS=547 php=9 phpRSS=1388 ap=48 tcp=67 topuser=madalice 2026-08-15 07:10:16 L1=2.38 run=19 blk=0 avail=7769 (66.2%) swpO=0 conn=15 myRSS=547 php=15 phpRSS=1773 ap=47 tcp=76 topuser=madalice 2026-08-15 07:10:25 L1=4.85 run=52 blk=1 avail=5475 (46.7%) swpO=0 conn=43 myRSS=549 php=43 phpRSS=4487 ap=82 tcp=90 topuser=madalice 2026-08-15 07:10:29 L1=4.85 run=49 blk=1 avail=4564 (38.9%) swpO=0 conn=46 myRSS=551 php=45 phpRSS=5528 ap=89 tcp=53 topuser=madalice 2026-08-15 07:10:35 L1=10.77 run=43 blk=0 avail=2810 (24.0%) swpO=0 conn=39 myRSS=552 php=41 phpRSS=6996 ap=82 tcp=46 topuser=madalice 2026-08-15 07:10:39 L1=10.22 run=4 blk=0 avail=8240 (70.3%) swpO=0 conn=46 myRSS=559 php=4 phpRSS=667 ap=79 tcp=42 topuser=madalice 2026-08-15 07:10:46 L1=9.56 run=6 blk=1 avail=8183 (69.8%) swpO=0 conn=39 myRSS=559 php=7 phpRSS=862 ap=72 tcp=31 topuser=madalice 2026-08-15 07:10:49 L1=9.20 run=5 blk=0 avail=8571 (73.1%) swpO=0 conn=46 myRSS=561 php=4 phpRSS=412 ap=69 tcp=29 topuser=olympic 2026-08-15 07:10:56 L1=8.78 run=2 blk=0 avail=8806 (75.1%) swpO=0 conn=39 myRSS=563 php=2 phpRSS=164 ap=62 tcp=29 topuser=madalice 2026-08-15 07:10:59 L1=8.16 run=2 blk=0 avail=8919 (76.0%) swpO=0 conn=46 myRSS=563 php=0 phpRSS=0 ap=59 tcp=24 topuser=- 2026-08-15 07:11:06 L1=7.51 run=1 blk=0 avail=8957 (76.4%) swpO=0 conn=39 myRSS=563 php=1 phpRSS=40 ap=52 tcp=20 topuser=evolution 2026-08-15 07:11:09 L1=6.90 run=1 blk=0 avail=8992 (76.7%) swpO=0 conn=1 myRSS=563 php=0 phpRSS=0 ap=49 tcp=21 topuser=- 2026-08-15 07:11:16 L1=6.35 run=1 blk=0 avail=9031 (77.0%) swpO=0 conn=39 myRSS=563 php=1 phpRSS=40 ap=42 tcp=22 topuser=evolution