INCIDENT 2026-08-16 22:17:30 trigger: swapout=2101/s ================================================================== load: 1.75 1.12 0.86 2/646 3978810 ncpu:10 mem_avail: 4403MB/11729MB (37.5%) swap_used:1813MB swapout:2101/s blocked(D):0 running:2 iowait:12.6% steal:0.0% php: 0 procs / 0MB heaviest user: - (0 procs, 0MB) apache: 22 procs tcp_estab: 17 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 3 2787 mysql 1 2132 root 239 890 nobody 21 279 netdata 8 252 mailnull 4 70 cpanellogin 1 58 dovenull 6 26 lowrange 2 24 wp-toolkit 6 19 zabbix 1 15 mailman 20 15 aaa 1 13 alison 1 12 kurri 1 11 coscom 1 11 nscd 1 8 dovecot 3 7 named 1 6 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3786 MB Active(file): 766 MB Inactive(file): 2851 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 456 MB CommitLimit: 9960 MB Committed_AS: 9422 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3201090 root 21:06:14 7468 /usr/bin/imunify-agent-proxy 3974561 root 04:34 61320 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3978614 3978613 madalice 2833552 92.7 RNs 00:24 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 2575700 1 mysql 2183808 2.7 Ssl 1-14:26:51 /usr/sbin/mariadbd 1220 1 netdata 203824 2.5 Ssl 48-12:07:33 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3255082 3247260 root 173184 0.0 S 19:41:40 spamd child 3247260 1 root 137284 0.0 Ss 19:54:10 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2575382 1 root 109508 0.0 Ss 1-14:26:54 /usr/lib/systemd/systemd-journald 3767579 3247260 root 103168 0.0 S 05:44:52 spamd child 3974561 1 root 61320 0.6 Ssl 04:34 /opt/imunify360/venv/bin/python3 -m imav.run 3970681 1353308 cpanellogin 60272 0.0 S 11:56 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2223 1201 root 41192 0.0 Sl 48-12:07:32 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 39672 0.0 Ss 25-19:36:03 cpsrvd (SSL) - waiting for connections 1469 1 root 38988 0.1 Ss 48-12:07:32 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33196 0.1 Sl 48-12:07:28 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3246151 1 root 24724 0.0 Ss 19:55:07 lfd - sleeping 3977629 3977624 root 23492 0.0 S 01:18 /usr/sbin/exim -q 3974305 3651816 root 21196 0.4 SN 04:35 cpanellogd - waiting for child to process logs for madalice 281734 1 mailnull 20960 0.0 Ss 7-19:55:21 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3977633 3977629 mailnull 20364 0.0 S 01:17 /usr/sbin/exim -q 3978609 3974305 madalice 20140 0.0 SN 00:25 cpanellogd - http logs for madalice 3977714 1276780 nobody 18032 0.0 S 01:14 /usr/sbin/httpd -k start 3977733 1276780 nobody 17732 0.0 S 01:13 /usr/sbin/httpd -k start 3977730 1276780 nobody 17652 0.0 S 01:13 /usr/sbin/httpd -k start 3978780 281734 mailnull 17320 0.0 S 00:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3977739 1276780 nobody 16800 0.0 S 01:13 /usr/sbin/httpd -k start 3977704 1276780 nobody 16600 0.0 S 01:16 /usr/sbin/httpd -k start 3977731 1276780 nobody 16260 0.0 S 01:13 /usr/sbin/httpd -k start 3977705 1276780 nobody 16076 0.0 S 01:15 /usr/sbin/httpd -k start 3977735 1276780 nobody 16072 0.0 S 01:13 /usr/sbin/httpd -k start 3977716 1276780 nobody 15960 0.0 S 01:14 /usr/sbin/httpd -k start 3977708 1276780 nobody 15880 0.0 S 01:15 /usr/sbin/httpd -k start 3978728 1276780 nobody 15628 0.0 S 00:10 /usr/sbin/httpd -k start 3978745 1276780 nobody 15604 0.0 S 00:09 /usr/sbin/httpd -k start 3978744 1276780 nobody 15592 0.1 S 00:09 /usr/sbin/httpd -k start 3978746 1276780 nobody 15592 0.0 S 00:09 /usr/sbin/httpd -k start 1204 1 zabbix 15416 0.2 Ssl 48-12:07:33 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 185104 2431 netdata 15340 2.0 Sl 4-01:43:51 /usr/libexec/netdata/plugins.d/apps.plugin 1 3978685 1276780 nobody 15048 0.0 S 00:11 /usr/sbin/httpd -k start 3488735 1471 root 15000 0.0 S 13:30:03 cPhulkd - dbprocessor 3978729 1276780 nobody 14612 0.0 S 00:10 /usr/sbin/httpd -k start 1463 1 root 14512 0.0 Ss 48-12:07:32 tailwatchd 1471 1 root 14432 0.0 Ss 48-12:07:32 cPhulkd - processor 3978675 281734 mailnull 14056 0.0 S 00:19 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3959600 3828812 aaa 13660 0.0 S 30:10 dovecot/imap 3977929 3828812 alison 13164 0.0 S 01:03 dovecot/imap 3966444 3828812 lowrange 12472 0.0 S 18:50 dovecot/imap 3975589 1276780 nobody 12368 0.0 S 03:20 /usr/sbin/httpd -k start 3971676 3828812 lowrange 12276 0.0 S 09:45 dovecot/imap 3972965 1276780 nobody 12052 0.0 S 06:56 /usr/sbin/httpd -k start 3816866 3828812 kurri 11544 0.0 S 04:26:29 dovecot/imap 3977624 281734 root 11528 0.0 S 01:18 /usr/sbin/exim -q 3978739 3828812 coscom 11272 0.0 S 00:10 dovecot/quota-status -p postfix 3975723 3828812 root 10992 0.0 S 03:11 dovecot/auth -w 3651378 1 nscd 8720 0.0 Ssl 8-19:54:35 /usr/sbin/nscd 1059098 3828812 dovenull 8524 0.0 S 3-06:44:38 dovecot/imap-login 1059102 3828812 dovenull 7960 0.0 S 3-06:44:38 dovecot/imap-login 3201090 1 root 7468 0.0 Ssl 21:06:14 /usr/bin/imunify-agent-proxy 1466 1 root 7216 0.0 Ss 48-12:07:32 dnsadmin - dormant mode 1 0 root 6936 0.2 Ss 48-12:07:41 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 2536732 1 named 6872 0.0 Ssl 44-19:55:20 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3651102 1 root 6600 0.0 Ss 8-19:54:46 queueprocd - waiting up to 60s to process a task --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 405008 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 92 aaa/aaadownunder.com.au 43 whiz/whizengineering.com.au-ssl_log 38 aaa/aaadownunder.com.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 23 customc/customcentral.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 6 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 80 40.80.82.167 60 158.23.18.197 38 172.182.217.32 31 40.74.65.169 23 203.54.180.238 12 43.228.157.166 3 114.119.130.40 1 2a03:2880:f802:c:: 1 2a03:2880:f802:43:: 1 217.113.194.165 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 23 GET /heartbeat.php 4 GET /store/design-your-own-sliders/ 3 GET /media.php 3 GET /8.php 3 GET /4PJcpMFsD8B.php 3 GET /3PJcpMFsD8B.php 2 GET /yj09.php 2 GET /xx.php 2 GET /xda.php 2 GET /wp-ws68.php 2 GET /wp-content/uploads/ 2 GET /wp-content/themes/seotheme/db.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-blog.php 2 GET /wp-admin/css/colors/sunrise/ 2 GET /wp-admin/css/colors/modern/ 2 GET /this_is_a_new_hello_world.php 2 GET /sf.php 2 GET /scxy.php 2 GET /ops.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 GET /zz.php 1 GET /zc-318.php 1 GET /yyy.php 1 GET /xmy.php 1 GET /xleet.php 1 GET /xda.php 1 GET /xa.php 1 GET /x7.php 1 GET /wsws.php 1 GET /wqqs.php 1 GET /wp-the.php 1 GET /wp-tem.php -- last 10 requests -- 158.23.18.197 - - [16/Aug/2026:22:15:24 +1000] "GET /05.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:25 +1000] "GET /public/hi.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:25 +1000] "GET /get.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:25 +1000] "GET /rpk.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:26 +1000] "GET /wp-blog.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:26 +1000] "GET /mga.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:27 +1000] "GET /fs.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:27 +1000] "GET /wp-tem.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:27 +1000] "GET /sadd.php HTTP/1.1" 401 36 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:28 +1000] "GET /ex.php HTTP/1.1" 401 36 "-" "-" == aaa/aaadownunder.com.au == -- top paths -- 1 GET /yj09.php 1 GET /xx.php 1 GET /wp-ws68.php 1 GET //wp-includes/l10n/ 1 GET //wp-includes/js/jquery/ 1 GET //wp-includes/css/dist/ 1 GET //wp-includes/assets/ 1 GET /wp-content/uploads/ 1 GET /wp-content/themes/index.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET //wp-content/admin.php 1 GET /wp-blog.php -- last 10 requests -- 40.80.82.167 - - [16/Aug/2026:22:15:14 +1000] "GET //wp-includes/l10n/ HTTP/1.1" 301 293 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:14 +1000] "GET /wp-content/uploads/ HTTP/1.1" 301 295 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:14 +1000] "GET //abcd.php HTTP/1.1" 301 284 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:15 +1000] "GET //cgi-bin/index.php HTTP/1.1" 301 293 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:15 +1000] "GET //wp-includes/css/dist/ HTTP/1.1" 301 297 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:15 +1000] "GET //adminfuns.php HTTP/1.1" 301 289 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:16 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 301 303 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:16 +1000] "GET /wp-blog.php HTTP/1.1" 301 287 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:16 +1000] "GET //wp-includes/js/jquery/ HTTP/1.1" 301 298 "-" "-" 40.80.82.167 - - [16/Aug/2026:22:15:17 +1000] "GET //wp-content/admin.php HTTP/1.1" 301 296 "-" "-" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 1 GET /xda.php 1 GET /wp-themes.php 1 GET /wp-links-opml.php 1 GET /wp-includes/PHPMailer 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/css 1 GET /wp-includes/blocks/search/index.php 1 GET /w.php 1 GET /wp-content/wp-conflg.php 1 GET /wp-content/plugins/index.php 1 GET /wp-content/packed.php 1 GET /wp-blog-header.php -- last 10 requests -- 172.182.217.32 - - [16/Aug/2026:22:16:09 +1000] "GET /wp-admin/images HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:09 +1000] "GET /wp-content/packed.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:09 +1000] "GET /wp-content/wp-conflg.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:09 +1000] "GET /wp-includes/PHPMailer HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:09 +1000] "GET /wp-themes.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:09 +1000] "GET /xda.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:09 +1000] "GET /.well-known/pki-validation/xmrlpc.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 172.182.217.32 - - [16/Aug/2026:22:16:10 +1000] "GET /15.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:10 +1000] "GET /403.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.182.217.32 - - [16/Aug/2026:22:16:10 +1000] "GET /404webshell.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-16 22:15:09 L1=1.08 run=3 blk=1 avail=4735 (40.4%) swpO=2366 conn=3 myRSS=2320 php=2 phpRSS=273 ap=21 tcp=33 topuser=corpkicks 2026-08-16 22:15:09 L1=1.08 run=8 blk=0 avail=4720 (40.2%) swpO=2392 conn=3 myRSS=2320 php=2 phpRSS=275 ap=21 tcp=33 topuser=corpkicks 2026-08-16 22:15:19 L1=1.22 run=2 blk=0 avail=4258 (36.3%) swpO=3733 conn=2 myRSS=2234 php=1 phpRSS=69 ap=22 tcp=29 topuser=evolution 2026-08-16 22:15:19 L1=1.22 run=2 blk=1 avail=4263 (36.3%) swpO=3854 conn=2 myRSS=2231 php=1 phpRSS=69 ap=22 tcp=29 topuser=evolution 2026-08-16 22:15:29 L1=1.42 run=5 blk=0 avail=3956 (33.7%) swpO=811 conn=2 myRSS=2212 php=1 phpRSS=117 ap=18 tcp=22 topuser=alison 2026-08-16 22:15:29 L1=1.42 run=4 blk=0 avail=3935 (33.6%) swpO=738 conn=2 myRSS=2211 php=1 phpRSS=140 ap=18 tcp=22 topuser=alison 2026-08-16 22:15:39 L1=1.36 run=2 blk=0 avail=6618 (56.4%) swpO=985 conn=2 myRSS=2195 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-16 22:15:39 L1=1.36 run=2 blk=0 avail=6553 (55.9%) swpO=962 conn=2 myRSS=2195 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-16 22:15:49 L1=1.38 run=2 blk=0 avail=7011 (59.8%) swpO=0 conn=2 myRSS=2195 php=0 phpRSS=0 ap=18 tcp=27 topuser=- 2026-08-16 22:15:49 L1=1.38 run=4 blk=0 avail=6942 (59.2%) swpO=0 conn=2 myRSS=2195 php=0 phpRSS=0 ap=18 tcp=27 topuser=- 2026-08-16 22:15:59 L1=1.88 run=6 blk=4 avail=5601 (47.8%) swpO=0 conn=2 myRSS=2195 php=1 phpRSS=261 ap=24 tcp=29 topuser=madalice 2026-08-16 22:15:59 L1=1.88 run=2 blk=0 avail=5818 (49.6%) swpO=0 conn=2 myRSS=2195 php=0 phpRSS=0 ap=24 tcp=29 topuser=- 2026-08-16 22:16:09 L1=1.75 run=4 blk=0 avail=6532 (55.7%) swpO=2 conn=2 myRSS=2195 php=1 phpRSS=70 ap=20 tcp=21 topuser=madalice 2026-08-16 22:16:09 L1=1.75 run=3 blk=0 avail=6426 (54.8%) swpO=2 conn=2 myRSS=2195 php=1 phpRSS=89 ap=20 tcp=22 topuser=madalice 2026-08-16 22:16:19 L1=1.71 run=3 blk=0 avail=6749 (57.5%) swpO=0 conn=2 myRSS=2195 php=1 phpRSS=97 ap=47 tcp=47 topuser=madalice 2026-08-16 22:16:19 L1=1.71 run=3 blk=0 avail=6733 (57.4%) swpO=0 conn=2 myRSS=2195 php=1 phpRSS=110 ap=47 tcp=46 topuser=madalice 2026-08-16 22:16:29 L1=1.60 run=1 blk=0 avail=6888 (58.7%) swpO=2 conn=2 myRSS=2195 php=0 phpRSS=0 ap=37 tcp=29 topuser=- 2026-08-16 22:16:29 L1=1.60 run=1 blk=0 avail=6888 (58.7%) swpO=2 conn=2 myRSS=2195 php=0 phpRSS=0 ap=37 tcp=28 topuser=- 2026-08-16 22:16:39 L1=1.36 run=1 blk=0 avail=6963 (59.4%) swpO=0 conn=2 myRSS=2195 php=0 phpRSS=0 ap=27 tcp=25 topuser=- 2026-08-16 22:16:40 L1=1.36 run=2 blk=0 avail=6964 (59.4%) swpO=0 conn=2 myRSS=2195 php=0 phpRSS=0 ap=27 tcp=25 topuser=- 2026-08-16 22:16:49 L1=1.37 run=2 blk=0 avail=6754 (57.6%) swpO=0 conn=2 myRSS=2195 php=0 phpRSS=0 ap=19 tcp=23 topuser=- 2026-08-16 22:16:50 L1=1.37 run=2 blk=0 avail=6746 (57.5%) swpO=0 conn=2 myRSS=2195 php=0 phpRSS=0 ap=19 tcp=23 topuser=- 2026-08-16 22:16:59 L1=1.16 run=2 blk=0 avail=6951 (59.3%) swpO=0 conn=2 myRSS=2195 php=1 phpRSS=90 ap=18 tcp=28 topuser=alison 2026-08-16 22:17:00 L1=1.16 run=2 blk=0 avail=6927 (59.1%) swpO=0 conn=2 myRSS=2195 php=1 phpRSS=112 ap=18 tcp=27 topuser=alison 2026-08-16 22:17:09 L1=1.22 run=3 blk=0 avail=6233 (53.1%) swpO=0 conn=1 myRSS=2195 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-16 22:17:10 L1=1.22 run=2 blk=0 avail=6150 (52.4%) swpO=0 conn=1 myRSS=2195 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-16 22:17:19 L1=1.27 run=5 blk=0 avail=4377 (37.3%) swpO=1486 conn=1 myRSS=2176 php=2 phpRSS=132 ap=18 tcp=31 topuser=customc 2026-08-16 22:17:20 L1=1.27 run=2 blk=1 avail=4347 (37.1%) swpO=1659 conn=1 myRSS=2171 php=2 phpRSS=168 ap=18 tcp=31 topuser=customc 2026-08-16 22:17:30 L1=1.75 run=2 blk=0 avail=4403 (37.5%) swpO=2101 conn=1 myRSS=2132 php=0 phpRSS=0 ap=22 tcp=17 topuser=- 2026-08-16 22:17:30 L1=1.75 run=4 blk=0 avail=4406 (37.6%) swpO=2138 conn=1 myRSS=2132 php=0 phpRSS=0 ap=21 tcp=17 topuser=-