INCIDENT 2026-08-16 03:31:22 trigger: php_rss=2693MB mysql_conn=16 ================================================================== load: 4.63 1.97 1.68 18/702 3290060 ncpu:10 mem_avail: 5127MB/11729MB (43.7%) swap_used:1395MB swapout:6/s blocked(D):0 running:17 iowait:0.2% steal:0.0% php: 17 procs / 2693MB heaviest user: madalice (16 procs, 2607MB) apache: 38 procs tcp_estab: 27 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 15 2196 mysql 1 1970 root 253 926 nobody 37 594 netdata 8 268 kurri 8 92 cpanellogin 1 65 mailnull 5 33 lowrange 2 25 dovenull 6 24 wp-toolkit 6 22 zabbix 1 17 mailman 20 15 candyfabcom 1 11 nscd 1 8 cpanelphpmyadmin 1 8 dovecot 3 7 named 1 6 polkitd 1 2 evolution 4 2 --- php workers by user --- USER PROCS RSS_MB madalice 15 2206 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5521 MB Active(file): 3856 MB Inactive(file): 829 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 593 MB CommitLimit: 9960 MB Committed_AS: 9511 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3201090 root 02:20:06 7404 /usr/bin/imunify-agent-proxy 3275201 root 23:21 3144 /bin/bash /etc/cron.daily/imunify-antivirus.cron 3275202 root 23:21 1416 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 3275203 root 23:21 8196 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 3275214 root 23:21 14904 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 3288242 root 02:23 60716 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2017448 2.6 Ssl 19:40:43 /usr/sbin/mariadbd 3290020 3288784 madalice 264288 73.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290004 3288788 madalice 251232 49.1 S 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290015 3289279 madalice 240828 68.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 220180 2.5 Ssl 47-17:21:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3290019 3288734 madalice 185820 57.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3255081 3247260 root 178772 0.0 S 55:32 spamd child 3247260 1 root 175040 0.1 Ss 01:08:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3290017 3289309 madalice 174352 48.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3255082 3247260 root 167208 0.0 S 55:32 spamd child 3290022 3288765 madalice 159740 61.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290018 3288697 madalice 142924 42.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290025 3288649 madalice 107960 57.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290027 3288685 madalice 104368 42.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290029 3289310 madalice 102104 34.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290024 3289278 madalice 101916 51.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290026 3288790 madalice 96692 45.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290031 3288770 madalice 91660 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3284662 1353308 cpanellogin 67008 0.0 S 08:10 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3288242 1 root 60716 0.9 Ssl 02:23 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 41764 0.0 Ss 25-00:49:55 cpsrvd (SSL) - waiting for connections 2223 1201 root 40896 0.0 Sl 47-17:21:24 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 38328 0.1 Ss 47-17:21:24 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 35784 0.1 Sl 47-17:21:20 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3246151 1 root 32888 0.0 Ss 01:08:59 lfd - sleeping 3288741 1276780 nobody 20168 0.0 S 01:28 /usr/sbin/httpd -k start 3289279 1276780 nobody 19480 0.1 S 01:02 /usr/sbin/httpd -k start 3289299 1276780 nobody 19456 0.0 S 01:01 /usr/sbin/httpd -k start 3288775 1276780 nobody 19304 0.0 S 01:27 /usr/sbin/httpd -k start 3288777 1276780 nobody 19300 0.0 S 01:27 /usr/sbin/httpd -k start 3288037 1276780 nobody 19296 0.0 S 02:44 /usr/sbin/httpd -k start 3288765 1276780 nobody 19212 0.0 S 01:27 /usr/sbin/httpd -k start 3289277 1276780 nobody 19112 0.0 S 01:02 /usr/sbin/httpd -k start 3288734 1276780 nobody 18960 0.0 S 01:28 /usr/sbin/httpd -k start 3288761 1276780 nobody 18916 0.0 S 01:27 /usr/sbin/httpd -k start 3288776 1276780 nobody 18916 0.0 S 01:27 /usr/sbin/httpd -k start 3288697 1276780 nobody 18900 0.0 S 01:29 /usr/sbin/httpd -k start 3288694 1276780 nobody 18792 0.0 S 01:29 /usr/sbin/httpd -k start 3288743 1276780 nobody 18788 0.0 S 01:28 /usr/sbin/httpd -k start 3288780 1276780 nobody 18744 0.0 S 01:27 /usr/sbin/httpd -k start 3289241 1276780 nobody 18744 0.0 S 01:04 /usr/sbin/httpd -k start 3288748 1276780 nobody 18712 0.0 S 01:28 /usr/sbin/httpd -k start 3288773 1276780 nobody 18700 0.0 S 01:27 /usr/sbin/httpd -k start 3289309 1276780 nobody 18668 0.0 S 01:01 /usr/sbin/httpd -k start 1204 1 zabbix 18132 0.2 Ssl 47-17:21:25 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2575382 1 root 18088 0.0 Ss 19:40:46 /usr/lib/systemd/systemd-journald 3288790 1276780 nobody 18032 0.0 S 01:27 /usr/sbin/httpd -k start 3288638 1276780 nobody 18016 0.0 S 01:32 /usr/sbin/httpd -k start 3288738 1276780 nobody 18008 0.0 S 01:28 /usr/sbin/httpd -k start 3288685 1276780 nobody 17996 0.0 S 01:30 /usr/sbin/httpd -k start 3288760 1276780 nobody 17896 0.0 S 01:27 /usr/sbin/httpd -k start 3288649 1276780 nobody 17860 0.0 S 01:31 /usr/sbin/httpd -k start 3288788 1276780 nobody 17768 0.0 S 01:27 /usr/sbin/httpd -k start 3288739 1276780 nobody 17760 0.0 S 01:28 /usr/sbin/httpd -k start 3288784 1276780 nobody 17600 0.0 S 01:27 /usr/sbin/httpd -k start 3289278 1276780 nobody 17452 0.2 S 01:02 /usr/sbin/httpd -k start 3270800 1471 root 17160 0.0 S 31:11 cPhulkd - dbprocessor 3288650 1276780 nobody 16940 0.0 S 01:31 /usr/sbin/httpd -k start 3289310 1276780 nobody 16924 0.0 S 01:01 /usr/sbin/httpd -k start 3288770 1276780 nobody 16764 0.0 S 01:27 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 190986 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min speedlin/speedlinefencing.com.au-ssl_log 285 madalice/madalice.com.au-ssl_log 234 aaa/aaadownunder.com.au-ssl_log 25 evolution/portal.evolutionerp.com.au-ssl_log 20 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 283 34.126.163.137 226 185.177.72.67 20 203.54.180.238 15 84.235.168.63 5 82.102.18.126 3 118.127.40.55 2 91.92.243.249 2 114.119.137.101 1 2a03:2880:f802:2a:: 1 178.156.224.227 1 157.55.39.56 1 146.70.194.220 1 114.119.159.70 1 114.119.143.14 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 26 GET /fetch 20 GET /heartbeat.php 15 POST /wp-admin/admin-ajax.php 6 GET /store/hand-painted-nike-af1-afl-port-adelaide2020/ 5 GET /proxy 3 POST /wp-login.php 3 POST /wp-cron.php 3 GET /@fs/proc/self/environ 3 GET /download 3 GET / 2 GET /webhook 2 GET /screenshot 2 GET /redirect 2 GET /read 2 GET /preview 2 GET /pms 2 GET /image 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /@fs/etc/passwd --- busiest 3 vhosts: top paths + last 10 requests --- == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 26 GET /fetch 5 GET /proxy 3 GET /@fs/proc/self/environ 3 GET /download 3 GET / 2 GET /webhook 2 GET /screenshot 2 GET /redirect 2 GET /read 2 GET /preview 2 GET /pms 2 GET /image -- last 10 requests -- 34.126.163.137 - - [16/Aug/2026:03:30:39 +1000] "GET /proxy?url=http%3A%2F%2Fmetadata.google.internal%2FcomputeMetadata%2Fv1%2Finstance%2Fservice-accounts%2Fdefault%2Ftoken HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (compatible 34.126.163.137 - - [16/Aug/2026:03:30:43 +1000] "GET /api/preview?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot. 34.126.163.137 - - [16/Aug/2026:03:30:45 +1000] "GET /fetch?url=http%3A%2F%2F169.254.169.254%2Fmetadata%2Fidentity%2Foauth2%2Ftoken%3Fapi-version%3D2018-02-01%26resource%3Dhttps%3A%2F%2Fmanagement.azure.com%2F HTTP/1.1" 34.126.163.137 - - [16/Aug/2026:03:30:46 +1000] "GET /proxy?url=http%3A%2F%2F169.254.169.254%2Fmetadata%2Fidentity%2Foauth2%2Ftoken%3Fapi-version%3D2018-02-01%26resource%3Dhttps%3A%2F%2Fmanagement.azure.com%2F HTTP/1.1" 34.126.163.137 - - [16/Aug/2026:03:30:49 +1000] "GET /fetch?url=file%3A%2F%2F%2Fproc%2Fself%2Fenviron HTTP/1.1" 404 3417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://open 178.156.224.227 - - [16/Aug/2026:03:30:46 +1000] "POST /wp-login.php HTTP/1.1" 503 18956 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 34.126.163.137 - - [16/Aug/2026:03:30:49 +1000] "GET /fetch?url=file%3A%2F%2F%2Fapp%2F.env HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 118.127.40.55 - - [16/Aug/2026:03:30:48 +1000] "POST /wp-cron.php?doing_wp_cron=1786815048.4611999988555908203125 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://speedlinefencing.com.au" 34.126.163.137 - - [16/Aug/2026:03:30:50 +1000] "GET /proxy?url=file%3A%2F%2F%2Fproc%2Fself%2Fenviron HTTP/1.1" 404 3417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com 34.126.163.137 - - [16/Aug/2026:03:30:50 +1000] "GET /fetch?url=file%3A%2F%2F%2Froot%2F.aws%2Fcredentials HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonb == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/hand-painted-nike-af1-afl-port-adelaide2020/ 1 POST / 1 GET /wholesale-at-mad-alice/ 1 GET /wedding-sneakers-for-the-bride/ 1 GET /we-customise-shoes-australia/ 1 GET /unique-custom-sneakers-are-the-ultimate-form-of-self-expression/ 1 GET /tmp/sendgrid.txt 1 GET /tmp/sendgrid.php 1 GET /tmp/sendgrid.env 1 GET /tmp/.env.sendgrid.test 1 GET /tmp/.env.sendgrid.staging 1 GET /tmp/.env.sendgrid.prod -- last 10 requests -- 185.177.72.67 - - [16/Aug/2026:03:31:08 +1000] "GET /store/bling-nike-crew-socks/ HTTP/1.1" 200 46306 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:08 +1000] "GET /store/mad-alice-custom-shoe-magnetic-drop-side-display-cases/ HTTP/1.1" 200 46631 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:09 +1000] "GET /the-ultimate-guide-to-sneaker-care-how-to-keep-your-custom-kicks-looking-fresh/ HTTP/1.1" 200 36416 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:10 +1000] "GET /how-to-paint-shoes-a-complete-guide-to-custom-sneaker-art-plus-when-to-call-in-the-pros/ HTTP/1.1" 200 35062 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:10 +1000] "GET /custom-shoes-in-australia-the-ultimate-guide-to-custom-sneakers/ HTTP/1.1" 200 35907 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:10 +1000] "GET /nike-air-force-1-wedding-shoes/ HTTP/1.1" 200 32928 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:10 +1000] "GET /10-reasons-to-wear-sneakers-on-your-wedding-day/ HTTP/1.1" 200 32431 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:10 +1000] "GET /mad-alice-custom-kicks-rutherford-shop/ HTTP/1.1" 200 33241 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:11 +1000] "GET /unique-custom-sneakers-are-the-ultimate-form-of-self-expression/ HTTP/1.1" 200 34598 "-" "curl/8.7.1" 185.177.72.67 - - [16/Aug/2026:03:31:12 +1000] "GET /wedding-sneakers-for-the-bride/ HTTP/1.1" 200 34683 "-" "curl/8.7.1" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 15 POST /wp-admin/admin-ajax.php 2 POST /wp-login.php 2 POST /wp-cron.php 1 GET /wp-includes/widgets/class-wp-widget-calendar.php 1 GET /wp-content/plugins/contact-form-7/ 1 GET /wp-content/plugins/classic-editor/ 1 GET /wp-content/fonts/ 1 GET /wp-admin/images/ 1 GET /wordpress/ -- last 10 requests -- 82.102.18.126 - - [16/Aug/2026:03:30:42 +1000] "GET /wp-content/plugins/contact-form-7/ HTTP/1.1" 404 - "-" "-" 84.235.168.63 - - [16/Aug/2026:03:30:42 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 400 1 "-" "python-requests/2.25.1" 84.235.168.63 - - [16/Aug/2026:03:30:50 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 400 1 "-" "python-requests/2.25.1" 118.127.40.55 - - [16/Aug/2026:03:30:56 +1000] "POST /wp-cron.php?doing_wp_cron=1786815056.2863280773162841796875 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://aaadownunder.com.au" 84.235.168.63 - - [16/Aug/2026:03:30:55 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 400 1 "-" "python-requests/2.25.1" 82.102.18.126 - - [16/Aug/2026:03:30:59 +1000] "GET /wordpress/ HTTP/1.1" 404 - "-" "-" 84.235.168.63 - - [16/Aug/2026:03:31:04 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 400 1 "-" "python-requests/2.25.1" 84.235.168.63 - - [16/Aug/2026:03:31:11 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 400 1 "-" "python-requests/2.25.1" 82.102.18.126 - - [16/Aug/2026:03:31:16 +1000] "GET /wp-admin/images/ HTTP/1.1" 200 17493 "-" "-" 84.235.168.63 - - [16/Aug/2026:03:31:18 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 400 1 "-" "python-requests/2.25.1" --- last 30 samples (run-up to this incident) --- 2026-08-16 03:29:01 L1=1.22 run=4 blk=0 avail=7095 (60.5%) swpO=0 conn=2 myRSS=1975 php=2 phpRSS=399 ap=22 tcp=28 topuser=madalice 2026-08-16 03:29:03 L1=1.21 run=2 blk=0 avail=7234 (61.7%) swpO=0 conn=4 myRSS=1975 php=1 phpRSS=181 ap=22 tcp=32 topuser=madalice 2026-08-16 03:29:11 L1=1.27 run=1 blk=0 avail=7444 (63.5%) swpO=0 conn=2 myRSS=1975 php=0 phpRSS=0 ap=21 tcp=26 topuser=- 2026-08-16 03:29:13 L1=1.33 run=2 blk=0 avail=7393 (63.0%) swpO=0 conn=4 myRSS=1975 php=1 phpRSS=91 ap=19 tcp=26 topuser=madalice 2026-08-16 03:29:21 L1=1.22 run=6 blk=0 avail=7345 (62.6%) swpO=0 conn=2 myRSS=1975 php=3 phpRSS=197 ap=19 tcp=27 topuser=tubesupplies 2026-08-16 03:29:24 L1=1.12 run=1 blk=0 avail=7452 (63.5%) swpO=0 conn=4 myRSS=1975 php=0 phpRSS=0 ap=19 tcp=27 topuser=- 2026-08-16 03:29:31 L1=1.11 run=1 blk=0 avail=7459 (63.6%) swpO=1 conn=2 myRSS=1975 php=0 phpRSS=0 ap=19 tcp=24 topuser=- 2026-08-16 03:29:34 L1=1.02 run=1 blk=0 avail=7464 (63.6%) swpO=1 conn=4 myRSS=1975 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-16 03:29:41 L1=0.94 run=1 blk=0 avail=7465 (63.6%) swpO=0 conn=2 myRSS=1975 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-16 03:29:44 L1=0.95 run=2 blk=0 avail=7342 (62.6%) swpO=0 conn=4 myRSS=1975 php=1 phpRSS=152 ap=17 tcp=30 topuser=madalice 2026-08-16 03:29:51 L1=0.95 run=2 blk=0 avail=7298 (62.2%) swpO=0 conn=2 myRSS=1975 php=1 phpRSS=177 ap=20 tcp=58 topuser=madalice 2026-08-16 03:29:54 L1=0.96 run=2 blk=0 avail=7273 (62.0%) swpO=0 conn=2 myRSS=1975 php=1 phpRSS=124 ap=32 tcp=67 topuser=madalice 2026-08-16 03:30:01 L1=0.88 run=4 blk=0 avail=6905 (58.9%) swpO=0 conn=2 myRSS=1975 php=3 phpRSS=230 ap=76 tcp=84 topuser=evolution 2026-08-16 03:30:04 L1=0.89 run=2 blk=0 avail=6761 (57.6%) swpO=0 conn=2 myRSS=1975 php=2 phpRSS=326 ap=76 tcp=84 topuser=madalice 2026-08-16 03:30:11 L1=0.82 run=3 blk=0 avail=6858 (58.5%) swpO=0 conn=2 myRSS=1975 php=2 phpRSS=305 ap=70 tcp=73 topuser=madalice 2026-08-16 03:30:14 L1=0.75 run=2 blk=0 avail=7061 (60.2%) swpO=0 conn=2 myRSS=1975 php=1 phpRSS=69 ap=68 tcp=59 topuser=evolution 2026-08-16 03:30:21 L1=0.77 run=3 blk=0 avail=6541 (55.8%) swpO=0 conn=2 myRSS=1975 php=3 phpRSS=481 ap=96 tcp=111 topuser=madalice 2026-08-16 03:30:24 L1=0.79 run=2 blk=0 avail=6757 (57.6%) swpO=0 conn=2 myRSS=1975 php=2 phpRSS=229 ap=96 tcp=75 topuser=madalice 2026-08-16 03:30:31 L1=0.81 run=2 blk=0 avail=6907 (58.9%) swpO=0 conn=2 myRSS=1975 php=1 phpRSS=110 ap=88 tcp=38 topuser=madalice 2026-08-16 03:30:34 L1=0.74 run=2 blk=0 avail=6998 (59.7%) swpO=0 conn=2 myRSS=1975 php=0 phpRSS=0 ap=86 tcp=35 topuser=- 2026-08-16 03:30:42 L1=0.76 run=2 blk=0 avail=7051 (60.1%) swpO=0 conn=2 myRSS=1976 php=1 phpRSS=54 ap=78 tcp=34 topuser=madalice 2026-08-16 03:30:44 L1=0.86 run=3 blk=0 avail=6895 (58.8%) swpO=0 conn=2 myRSS=1976 php=1 phpRSS=205 ap=76 tcp=33 topuser=madalice 2026-08-16 03:30:52 L1=1.03 run=1 blk=0 avail=7133 (60.8%) swpO=1 conn=1 myRSS=1976 php=0 phpRSS=0 ap=68 tcp=35 topuser=- 2026-08-16 03:30:54 L1=1.51 run=9 blk=0 avail=6109 (52.1%) swpO=1 conn=6 myRSS=1976 php=6 phpRSS=1227 ap=66 tcp=40 topuser=madalice 2026-08-16 03:31:02 L1=2.03 run=7 blk=0 avail=6554 (55.9%) swpO=224 conn=1 myRSS=1970 php=6 phpRSS=823 ap=58 tcp=29 topuser=madalice 2026-08-16 03:31:04 L1=3.15 run=8 blk=0 avail=6374 (54.3%) swpO=224 conn=6 myRSS=1970 php=7 phpRSS=1045 ap=56 tcp=37 topuser=madalice 2026-08-16 03:31:12 L1=3.54 run=9 blk=0 avail=6159 (52.5%) swpO=0 conn=1 myRSS=1970 php=8 phpRSS=1328 ap=48 tcp=36 topuser=madalice 2026-08-16 03:31:14 L1=4.86 run=20 blk=0 avail=6328 (54.0%) swpO=0 conn=6 myRSS=1970 php=11 phpRSS=1301 ap=45 tcp=35 topuser=madalice 2026-08-16 03:31:22 L1=4.63 run=17 blk=0 avail=5127 (43.7%) swpO=6 conn=16 myRSS=1970 php=17 phpRSS=2693 ap=38 tcp=27 topuser=madalice 2026-08-16 03:31:24 L1=4.66 run=21 blk=0 avail=5343 (45.6%) swpO=6 conn=18 myRSS=1970 php=19 phpRSS=2333 ap=34 tcp=36 topuser=madalice