INCIDENT 2026-08-15 21:57:56 trigger: php_procs=31 php_rss=3411MB mysql_conn=27 ================================================================== load: 9.29 8.69 4.11 35/737 3067783 ncpu:10 mem_avail: 5554MB/11729MB (47.4%) swap_used:2122MB swapout:0/s blocked(D):0 running:41 iowait:0.2% steal:0.0% php: 31 procs / 3411MB heaviest user: madalice (29 procs, 3231MB) apache: 88 procs tcp_estab: 118 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 29 2998 mysql 1 1377 nobody 87 1270 root 234 333 netdata 8 225 speedlin 1 148 evolution 5 41 kurri 7 29 wp-toolkit 6 15 cpanellogin 1 14 zabbix 1 13 mailnull 3 13 mailman 20 11 corpkicks 1 11 dovenull 6 8 dovecot 3 7 alison 1 6 nscd 1 4 polkitd 1 2 named 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 30 3066 speedlin 1 80 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2223 MB Active(file): 668 MB Inactive(file): 282 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 162 MB CommitLimit: 9960 MB Committed_AS: 12794 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 20:46:41 0 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 1410620 2.5 Ssl 14:07:17 /usr/sbin/mariadbd 3067705 3067700 madalice 232208 44.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067712 3067707 madalice 224252 68.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 175116 2.5 Ssl 47-11:47:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3067727 3067682 madalice 166584 72.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067724 3067677 madalice 164560 48.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067738 3067475 madalice 136684 55.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067726 3067672 madalice 129948 52.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067732 3067652 madalice 126024 50.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067725 3067671 madalice 123576 59.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067723 3067708 madalice 122828 33.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067730 3067655 madalice 116936 48.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067734 3067476 madalice 109272 38.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067729 3067496 madalice 106780 39.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067731 3067654 madalice 105432 36.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067733 3067658 madalice 103472 35.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067768 3067474 madalice 92256 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067735 3065696 madalice 92204 30.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067746 3067681 madalice 91796 50.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067747 3067596 madalice 91396 55.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 86072 0.0 Ss 14:07:20 /usr/lib/systemd/systemd-journald 3067736 3065187 madalice 83744 23.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067739 3065712 madalice 81688 46.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067737 3066018 madalice 81080 25.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067744 3067717 madalice 79776 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067753 3067668 madalice 73304 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067742 3067676 madalice 72048 31.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067740 3067669 madalice 71380 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067741 3067667 madalice 67128 26.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067782 3067484 madalice 60356 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067748 3067697 madalice 59668 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067769 3067673 madalice 59092 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3067796 3067680 madalice 58512 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390234 2382613 root 55124 0.0 S 19:22:19 spamd child 3067802 3067622 madalice 42232 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4922 2431 netdata 37928 0.1 Sl 47-11:47:54 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2856464 2382613 root 32396 0.0 S 06:13:01 spamd child 2223 1201 root 27828 0.0 Sl 47-11:47:58 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3067624 1276780 nobody 18904 0.2 R 00:10 /usr/sbin/httpd -k start 3067496 1276780 nobody 18628 0.2 S 00:22 /usr/sbin/httpd -k start 3067487 1276780 nobody 17940 0.0 S 00:23 /usr/sbin/httpd -k start 3067474 1276780 nobody 17456 0.1 S 00:26 /usr/sbin/httpd -k start 3067482 1276780 nobody 17384 0.0 S 00:24 /usr/sbin/httpd -k start 3067680 1276780 nobody 17304 0.2 S 00:08 /usr/sbin/httpd -k start 3066018 1276780 nobody 17192 0.0 S 02:51 /usr/sbin/httpd -k start 3067504 1276780 nobody 17168 0.0 S 00:22 /usr/sbin/httpd -k start 3067201 1276780 nobody 17156 0.0 S 01:01 /usr/sbin/httpd -k start 3067489 1276780 nobody 17136 0.0 S 00:23 /usr/sbin/httpd -k start 3067625 1276780 nobody 17136 0.2 S 00:10 /usr/sbin/httpd -k start 3067657 1276780 nobody 17128 0.1 S 00:09 /usr/sbin/httpd -k start 3067484 1276780 nobody 17112 0.0 S 00:23 /usr/sbin/httpd -k start 3067676 1276780 nobody 17104 0.1 S 00:08 /usr/sbin/httpd -k start 3067656 1276780 nobody 17088 0.2 S 00:09 /usr/sbin/httpd -k start 3067506 1276780 nobody 17060 0.0 S 00:22 /usr/sbin/httpd -k start 3067655 1276780 nobody 17008 0.2 S 00:09 /usr/sbin/httpd -k start 3067658 1276780 nobody 16996 0.2 S 00:09 /usr/sbin/httpd -k start 3067678 1276780 nobody 16992 0.0 S 00:08 /usr/sbin/httpd -k start 3067679 1276780 nobody 16984 0.2 S 00:08 /usr/sbin/httpd -k start 3067681 1276780 nobody 16972 0.1 S 00:08 /usr/sbin/httpd -k start 3067669 1276780 nobody 16952 0.1 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 151279 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 89 speedlin/speedlinefencing.com.au 38 speedlin/speedlinefencing.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 25 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 73 20.104.100.201 25 203.54.180.238 5 202.153.211.134 2 47.82.201.226 2 212.47.136.56 2 197.184.174.68 1 93.38.26.151 1 87.200.207.52 1 82.33.186.235 1 77.235.129.92 1 66.249.65.171 1 58.97.217.122 1 49.237.95.16 1 47.82.202.195 1 47.82.202.193 --- top request paths across all vhosts (last 3 min) --- 31 POST / 31 GET / 25 GET /heartbeat.php 3 GET /wp-admin/ 2 GET /zwq.php 2 GET /xy.php 2 GET /x1da.php 2 GET /wp-tymanage.php 2 GET /wp-stat.php 2 GET /wp-michan.php 2 GET /unloathness.php 2 GET /tiny2.php 2 GET /qyffk.php 2 GET /prosell2.php 2 GET /pjkkq.php 2 GET /ohfiw.php 2 GET /nti.php 2 GET /nco.php 2 GET /multirole.php 2 GET /lolz.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 31 POST / 31 GET / 3 GET /wp-admin/ 1 POST /wp-login.php 1 POST /wp-admin/admin-ajax.php 1 GET /wp-login.php 1 GET /wp-content/plugins/woo-custom-product-addons-pro/assets/images/ 1 GET /transform-your-sneakers-with-expert-jordan-customization/ 1 GET /tag/moun-tain/ 1 GET /store/pink-butterfly-drippy-af1-shoes/ 1 GET /store/pearl-and-heart-shoe-charm-set/ 1 GET /store/custom-sneakers-sprinkles/ -- last 10 requests -- 114.130.67.224 - - [15/Aug/2026:21:57:49 +1000] "GET /tag/moun-tain/ HTTP/1.1" 200 29268 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 202.165.87.105 - - [15/Aug/2026:21:57:49 +1000] "GET /store/custom-sneakers-sprinkles/ HTTP/1.1" 200 48089 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safa 151.0.50.218 - - [15/Aug/2026:21:57:48 +1000] "GET /product-category/accessories/page/2/?srsltid=AfmBOopexfCkByUWJxmKOUc1fdvIOWhc4PrqMR2q812esviM5IbBI0Oo HTTP/1.1" 200 34030 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10 217.19.221.143 - - [15/Aug/2026:21:57:49 +1000] "GET /store/pink-butterfly-drippy-af1-shoes/ HTTP/1.1" 200 47999 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0. 14.249.103.128 - - [15/Aug/2026:21:57:49 +1000] "GET /product-tag/cartoon/ HTTP/1.1" 200 30515 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 170.81.156.12 - - [15/Aug/2026:21:57:50 +1000] "GET /store/air-max-90-blue-and-black-drippy-copy/ HTTP/1.1" 200 43715 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145 41.223.73.224 - - [15/Aug/2026:21:57:49 +1000] "GET /store/pearl-and-heart-shoe-charm-set/ HTTP/1.1" 200 45332 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 103.206.136.69 - - [15/Aug/2026:21:57:50 +1000] "GET /store/custom-af1-rose-and-thorn-edition/ HTTP/1.1" 200 47726 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. 41.208.141.115 - - [15/Aug/2026:21:57:49 +1000] "GET /brand/vans-custom-sneakers/ HTTP/1.1" 200 29652 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/53 37.52.125.149 - - [15/Aug/2026:21:57:51 +1000] "GET /product-tag/rainbow/ HTTP/1.1" 200 30036 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" == speedlin/speedlinefencing.com.au == -- top paths -- 1 GET /zwq.php 1 GET /xy.php 1 GET /x1da.php 1 GET /wp-tymanage.php 1 GET /wp-stat.php 1 GET /wp-mter.php 1 GET /wp-michan.php 1 GET /unloathness.php 1 GET /tiny2.php 1 GET /swallowable.php 1 GET /qyffk.php 1 GET /prosell2.php -- last 10 requests -- 20.104.100.201 - - [15/Aug/2026:21:56:34 +1000] "GET /x1da.php HTTP/1.1" 301 288 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:36 +1000] "GET /ew.php HTTP/1.1" 301 286 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:38 +1000] "GET /bal.php HTTP/1.1" 301 287 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:40 +1000] "GET /kj.php HTTP/1.1" 301 286 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:42 +1000] "GET /wp-michan.php HTTP/1.1" 301 293 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:44 +1000] "GET /av.php HTTP/1.1" 301 286 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:46 +1000] "GET /f6.php HTTP/1.1" 301 286 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:48 +1000] "GET /fvvff.php HTTP/1.1" 301 289 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:50 +1000] "GET /swallowable.php HTTP/1.1" 301 295 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:52 +1000] "GET /wp-mter.php HTTP/1.1" 301 291 "-" "-" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 1 GET /zwq.php 1 GET /xy.php 1 GET /x1da.php 1 GET /wp-tymanage.php 1 GET /wp-stat.php 1 GET /wp-michan.php 1 GET /unloathness.php 1 GET /tiny2.php 1 GET /qyffk.php 1 GET /prosell2.php 1 GET /pjkkq.php 1 GET /ohfiw.php -- last 10 requests -- 20.104.100.201 - - [15/Aug/2026:21:56:29 +1000] "GET /ohfiw.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:31 +1000] "GET /zwq.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:33 +1000] "GET /19.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:35 +1000] "GET /x1da.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:37 +1000] "GET /ew.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:39 +1000] "GET /bal.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:40 +1000] "GET /kj.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:42 +1000] "GET /wp-michan.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:44 +1000] "GET /av.php HTTP/1.1" 404 44492 "-" "-" 20.104.100.201 - - [15/Aug/2026:21:56:46 +1000] "GET /f6.php HTTP/1.1" 404 44492 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 21:55:27 L1=28.64 run=82 blk=7 avail=171 (1.5%) swpO=43132 conn=47 myRSS=1382 php=60 phpRSS=6610 ap=105 tcp=36 topuser=madalice 2026-08-15 21:55:27 L1=28.64 run=75 blk=10 avail=174 (1.5%) swpO=35722 conn=47 myRSS=1381 php=60 phpRSS=6456 ap=107 tcp=36 topuser=madalice 2026-08-15 21:55:45 L1=42.08 run=20 blk=2 avail=5986 (51.0%) swpO=4018 conn=15 myRSS=1349 php=18 phpRSS=2722 ap=87 tcp=34 topuser=madalice 2026-08-15 21:55:45 L1=42.08 run=22 blk=2 avail=6006 (51.2%) swpO=4278 conn=14 myRSS=1349 php=18 phpRSS=2656 ap=87 tcp=34 topuser=madalice 2026-08-15 21:55:55 L1=35.76 run=2 blk=1 avail=8403 (71.6%) swpO=0 conn=15 myRSS=1360 php=2 phpRSS=148 ap=75 tcp=30 topuser=speedlin 2026-08-15 21:55:55 L1=35.76 run=6 blk=1 avail=8401 (71.6%) swpO=0 conn=14 myRSS=1360 php=2 phpRSS=151 ap=75 tcp=30 topuser=speedlin 2026-08-15 21:56:05 L1=30.49 run=3 blk=1 avail=8381 (71.5%) swpO=0 conn=14 myRSS=1361 php=2 phpRSS=164 ap=65 tcp=29 topuser=speedlin 2026-08-15 21:56:07 L1=30.49 run=2 blk=1 avail=8480 (72.3%) swpO=0 conn=15 myRSS=1361 php=0 phpRSS=0 ap=64 tcp=33 topuser=- 2026-08-15 21:56:16 L1=26.18 run=4 blk=1 avail=8350 (71.2%) swpO=0 conn=3 myRSS=1361 php=2 phpRSS=175 ap=55 tcp=27 topuser=speedlin 2026-08-15 21:56:17 L1=26.18 run=2 blk=0 avail=8458 (72.1%) swpO=0 conn=2 myRSS=1361 php=1 phpRSS=45 ap=54 tcp=26 topuser=speedlin 2026-08-15 21:56:26 L1=22.47 run=2 blk=0 avail=8359 (71.3%) swpO=0 conn=3 myRSS=1362 php=2 phpRSS=184 ap=45 tcp=33 topuser=speedlin 2026-08-15 21:56:27 L1=22.47 run=2 blk=0 avail=8475 (72.3%) swpO=0 conn=2 myRSS=1362 php=1 phpRSS=49 ap=44 tcp=32 topuser=speedlin 2026-08-15 21:56:36 L1=19.08 run=5 blk=0 avail=8407 (71.7%) swpO=0 conn=3 myRSS=1364 php=2 phpRSS=180 ap=35 tcp=26 topuser=speedlin 2026-08-15 21:56:37 L1=19.08 run=2 blk=0 avail=8515 (72.6%) swpO=0 conn=2 myRSS=1364 php=1 phpRSS=51 ap=34 tcp=27 topuser=speedlin 2026-08-15 21:56:46 L1=16.46 run=1 blk=0 avail=8560 (73.0%) swpO=0 conn=3 myRSS=1365 php=1 phpRSS=40 ap=25 tcp=27 topuser=evolution 2026-08-15 21:56:47 L1=16.46 run=2 blk=0 avail=8545 (72.9%) swpO=0 conn=2 myRSS=1365 php=1 phpRSS=66 ap=24 tcp=28 topuser=speedlin 2026-08-15 21:56:56 L1=14.07 run=1 blk=0 avail=8494 (72.4%) swpO=0 conn=3 myRSS=1366 php=2 phpRSS=40 ap=22 tcp=32 topuser=evolution 2026-08-15 21:56:57 L1=14.07 run=3 blk=0 avail=8535 (72.8%) swpO=0 conn=2 myRSS=1366 php=1 phpRSS=64 ap=22 tcp=32 topuser=speedlin 2026-08-15 21:57:06 L1=12.06 run=1 blk=0 avail=8548 (72.9%) swpO=0 conn=3 myRSS=1367 php=1 phpRSS=40 ap=22 tcp=33 topuser=evolution 2026-08-15 21:57:07 L1=12.06 run=3 blk=0 avail=8510 (72.6%) swpO=0 conn=2 myRSS=1367 php=1 phpRSS=80 ap=22 tcp=35 topuser=speedlin 2026-08-15 21:57:16 L1=10.36 run=1 blk=0 avail=8555 (72.9%) swpO=0 conn=2 myRSS=1367 php=1 phpRSS=40 ap=21 tcp=25 topuser=evolution 2026-08-15 21:57:17 L1=10.36 run=2 blk=0 avail=8514 (72.6%) swpO=0 conn=2 myRSS=1367 php=1 phpRSS=101 ap=21 tcp=25 topuser=speedlin 2026-08-15 21:57:26 L1=9.08 run=5 blk=0 avail=8203 (69.9%) swpO=0 conn=2 myRSS=1368 php=4 phpRSS=487 ap=19 tcp=26 topuser=madalice 2026-08-15 21:57:27 L1=9.08 run=2 blk=0 avail=8313 (70.9%) swpO=0 conn=2 myRSS=1368 php=2 phpRSS=314 ap=19 tcp=28 topuser=madalice 2026-08-15 21:57:36 L1=7.84 run=4 blk=0 avail=8107 (69.1%) swpO=0 conn=2 myRSS=1369 php=4 phpRSS=381 ap=50 tcp=53 topuser=customc 2026-08-15 21:57:37 L1=7.84 run=2 blk=0 avail=8302 (70.8%) swpO=0 conn=2 myRSS=1369 php=1 phpRSS=99 ap=49 tcp=49 topuser=madalice 2026-08-15 21:57:46 L1=6.79 run=2 blk=0 avail=8350 (71.2%) swpO=0 conn=2 myRSS=1371 php=1 phpRSS=67 ap=44 tcp=71 topuser=speedlin 2026-08-15 21:57:47 L1=6.79 run=1 blk=0 avail=8347 (71.2%) swpO=0 conn=2 myRSS=1371 php=1 phpRSS=40 ap=48 tcp=75 topuser=evolution 2026-08-15 21:57:56 L1=9.29 run=41 blk=0 avail=5554 (47.4%) swpO=0 conn=27 myRSS=1377 php=31 phpRSS=3411 ap=88 tcp=118 topuser=madalice 2026-08-15 21:57:57 L1=9.29 run=41 blk=0 avail=5518 (47.0%) swpO=0 conn=31 myRSS=1377 php=33 phpRSS=3549 ap=90 tcp=120 topuser=madalice