INCIDENT 2026-08-19 02:57:50 trigger: php_rss=2054MB mysql_conn=15 ================================================================== load: 1.84 1.87 1.55 24/767 2135565 ncpu:10 mem_avail: 4443MB/11729MB (37.9%) swap_used:2254MB swapout:324/s blocked(D):0 running:22 iowait:0.2% steal:0.0% php: 16 procs / 2054MB heaviest user: madalice (15 procs, 1946MB) apache: 153 procs tcp_estab: 144 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 152 2380 mysql 1 2322 madalice 16 1913 root 241 914 mailman 20 370 netdata 8 251 olympic 1 128 kurri 6 67 cpanellogin 1 62 named 1 57 infinium 3 34 lowrange 2 22 dovenull 6 22 mailnull 1 18 wp-toolkit 6 16 zabbix 1 14 aaa 1 12 evolution 4 10 dovecot 3 6 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 16 1953 olympic 1 130 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4877 MB Active(file): 3286 MB Inactive(file): 676 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 566 MB CommitLimit: 9960 MB Committed_AS: 11830 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2064673 root 01:46:34 7236 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2371872 10.1 Ssl 3-19:07:13 /usr/sbin/mariadbd 2135461 2135119 madalice 230684 75.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135467 2135437 madalice 223748 68.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135500 2135489 madalice 210012 111 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135502 2135480 madalice 208232 107 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 204468 2.5 Ssl 50-16:47:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2135504 2135484 madalice 180980 86.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2122938 2112450 root 180856 0.0 S 19:21 spamd child 2122939 2112450 root 178356 0.0 S 19:21 spamd child 2135506 2135479 madalice 177128 77.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2112450 1 root 174272 0.2 Ss 34:17 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2135507 2135483 madalice 136772 57.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135509 2135123 olympic 126636 137 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135505 2135485 madalice 116988 51.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135503 2135481 madalice 116180 53.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135531 2135158 madalice 110800 83.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135508 2135499 madalice 107940 44.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135532 2135375 madalice 82552 54.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135556 2135433 madalice 72600 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135534 2135163 madalice 71948 34.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2135533 2133936 madalice 71536 32.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2120937 1353308 cpanellogin 63964 0.0 S 21:22 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 2107664 1 named 59344 0.0 Ssl 35:09 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2135563 2135367 madalice 59128 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 40940 0.0 Ss 28-00:16:25 cpsrvd (SSL) - waiting for connections 1469 1 root 40484 0.1 Ss 50-16:47:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2223 1201 root 39768 0.0 Sl 50-16:47:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2575382 1 root 38580 0.0 Ss 3-19:07:16 /usr/lib/systemd/systemd-journald 2111676 1 root 31992 0.0 Ss 34:47 lfd - sleeping 4922 2431 netdata 31056 0.1 Sl 50-16:47:50 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1463 1 root 25600 0.0 Ss 50-16:47:54 tailwatchd 2135128 1276780 nobody 20464 0.0 S 00:37 /usr/sbin/httpd -k start 2133936 1276780 nobody 20380 0.0 S 02:59 /usr/sbin/httpd -k start 2133108 1276780 nobody 20296 0.0 S 04:24 /usr/sbin/httpd -k start 2111816 2111790 mailman 20132 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 2111818 2111790 mailman 20128 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 2111822 2111790 mailman 20128 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 2133116 1276780 nobody 20128 0.0 S 04:24 /usr/sbin/httpd -k start 2133920 1276780 nobody 20100 0.0 S 03:00 /usr/sbin/httpd -k start 2111819 2111790 mailman 20092 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 2111817 2111790 mailman 20000 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 2111821 2111790 mailman 19996 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 2111823 2111790 mailman 19980 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 2133937 1276780 nobody 19936 0.0 S 02:59 /usr/sbin/httpd -k start 2111808 2111790 mailman 19868 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 2134896 1276780 nobody 19832 0.1 S 01:06 /usr/sbin/httpd -k start 2111812 2111790 mailman 19792 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 2135118 1276780 nobody 19784 0.0 S 00:39 /usr/sbin/httpd -k start 2111813 2111790 mailman 19740 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 2111809 2111790 mailman 19732 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 2111820 2111790 mailman 19716 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 2134909 1276780 nobody 19700 0.0 S 01:05 /usr/sbin/httpd -k start 2134913 1276780 nobody 19676 0.0 S 01:05 /usr/sbin/httpd -k start 2111811 2111790 mailman 19652 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 2111814 2111790 mailman 19652 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 2134893 1276780 nobody 19648 0.0 S 01:06 /usr/sbin/httpd -k start 2111825 2111790 mailman 19644 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 2111815 2111790 mailman 19592 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 2135163 1276780 nobody 19556 0.1 S 00:36 /usr/sbin/httpd -k start 2111810 2111790 mailman 19536 0.0 S 34:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10082527 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10082526 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 108 evolution/portal.evolutionerp.com.au-ssl_log 27 bigdeals/bigdeals.com.au 21 evolution/my.evolutionerp.com.au-ssl_log 19 vinesit/westpanel.vinesit.com.au-ssl_log 19 customc/customcentral.com.au-ssl_log 14 evolution/evolutionerp.com.au-ssl_log 6 evolution/evolutionerp.com.au 5 alison/alisonarts.com.au-ssl_log 4 otter2/otterfencing.net.au 4 otter2/otterfencing.net.au-ssl_log 4 aaa/aaadownunder.com.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 2 corpkicks/2025.corporatekicks.com.au-ssl_log 1 olympic/olympicfencing.com.au-ssl_log 1 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 58 20.151.109.219 27 203.54.180.238 25 1.43.89.82 21 146.70.40.68 19 88.151.33.92 11 20.104.49.167 11 106.219.166.143 9 118.127.40.55 8 141.98.11.42 5 54.86.66.252 4 54.175.74.27 3 54.209.60.63 3 184.72.121.156 2 89.42.48.179 2 84.235.249.236 --- top request paths across all vhosts (last 3 min) --- 29 GET / 27 GET /heartbeat.php 19 GET /index.php 13 POST / 7 GET /store/custom-nike-af1-sunflower-kids/ 4 POST /index.php 3 POST /wp-cron.php 3 HEAD / 3 GET /product-category/customised-shoes/kids/ 3 GET /admin.php 2 POST /wp-login.php 2 HEAD /bc 2 GET /xmlrpc.php 2 GET /nox.php 2 GET /file1221.php 2 GET /aw.php 2 GET /av.php 2 GET /akismet.php 2 GET /ajax.php 1 POST /wp-admin/admin-ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 13 POST / 13 GET / 7 GET /store/custom-nike-af1-sunflower-kids/ 3 GET /product-category/customised-shoes/kids/ 2 GET /aw.php 2 GET /av.php 1 HEAD /product-category/customised-shoes/womens/page/2/ 1 HEAD /product-category/customised-shoes/womens/ 1 HEAD /product-category/customised-shoes/kids/ 1 GET /xwpg.php 1 GET /wso.php 1 GET /wp-json/wc/store/v1/products/29711 -- last 10 requests -- 1.43.89.82 - - [19/Aug/2026:02:57:48 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/product-category/customised-shoes/womens/page/2/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 li 66.118.56.53 - - [19/Aug/2026:02:57:47 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/design-your-own-sliders/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS 172.121.87.4 - - [19/Aug/2026:02:57:48 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/design-your-own-sliders/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS 212.70.6.223 - - [19/Aug/2026:02:57:49 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/5 89.42.48.179 - - [19/Aug/2026:02:57:48 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/design-your-own-sliders/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 23.109.180.50 - - [19/Aug/2026:02:57:48 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/design-your-own-sliders/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac O 89.42.48.179 - - [19/Aug/2026:02:57:48 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/design-your-own-sliders/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 140.174.116.253 - - [19/Aug/2026:02:57:48 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/design-your-own-sliders/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X 20.151.109.219 - - [19/Aug/2026:02:57:49 +1000] "GET /p0wny.php HTTP/1.1" 404 30568 "-" "-" 172.121.87.4 - - [19/Aug/2026:02:57:48 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/design-your-own-sliders/" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) A == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 27 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [19/Aug/2026:02:56:25 +1000] "GET /heartbeat.php?sentAt=1787072186&bytes=106,132,142,186&_=1787032955757 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:56:32 +1000] "GET /heartbeat.php?sentAt=1787072192&bytes=106,132,142,192&_=1787056649825 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:56:35 +1000] "GET /heartbeat.php?sentAt=1787072196&bytes=106,132,142,196&_=1787032955758 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:56:43 +1000] "GET /heartbeat.php?sentAt=1787072202&bytes=106,132,142,202&_=1787056649826 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:56:45 +1000] "GET /heartbeat.php?sentAt=1787072206&bytes=106,132,142,206&_=1787032955759 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:56:52 +1000] "GET /heartbeat.php?sentAt=1787072212&bytes=106,132,142,212&_=1787056649827 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:56:55 +1000] "GET /heartbeat.php?sentAt=1787072216&bytes=106,132,142,216&_=1787032955760 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:57:02 +1000] "GET /heartbeat.php?sentAt=1787072222&bytes=106,132,142,222&_=1787056649828 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:57:05 +1000] "GET /heartbeat.php?sentAt=1787072226&bytes=106,132,142,226&_=1787032955761 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:02:57:13 +1000] "GET /heartbeat.php?sentAt=1787072232&bytes=106,132,142,232&_=1787056649829 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == bigdeals/bigdeals.com.au == -- top paths -- 3 GET / 1 GET /xmlrpc.php 1 GET /wp/wp-includes/wlwmanifest.xml 1 GET /wp-includes/wlwmanifest.xml 1 GET /wp2/wp-includes/wlwmanifest.xml 1 GET /wp1/wp-includes/wlwmanifest.xml 1 GET /wordpress/wp-includes/wlwmanifest.xml 1 GET /web/wp-includes/wlwmanifest.xml 1 GET /website/wp-includes/wlwmanifest.xml 1 GET /test/wp-includes/wlwmanifest.xml 1 GET /sito/wp-includes/wlwmanifest.xml 1 GET /site/wp-includes/wlwmanifest.xml -- last 10 requests -- 146.70.40.68 - - [19/Aug/2026:02:55:49 +1000] "GET /2018/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 146.70.40.68 - - [19/Aug/2026:02:55:50 +1000] "GET /2019/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 146.70.40.68 - - [19/Aug/2026:02:55:50 +1000] "GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 146.70.40.68 - - [19/Aug/2026:02:55:50 +1000] "GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 146.70.40.68 - - [19/Aug/2026:02:55:50 +1000] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 146.70.40.68 - - [19/Aug/2026:02:55:51 +1000] "GET /media/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/53 146.70.40.68 - - [19/Aug/2026:02:55:51 +1000] "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 146.70.40.68 - - [19/Aug/2026:02:55:51 +1000] "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 146.70.40.68 - - [19/Aug/2026:02:55:52 +1000] "GET /cms/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 146.70.40.68 - - [19/Aug/2026:02:55:52 +1000] "GET /sito/wp-includes/wlwmanifest.xml HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 --- last 30 samples (run-up to this incident) --- 2026-08-19 02:55:29 L1=2.92 run=4 blk=0 avail=6306 (53.8%) swpO=0 conn=3 myRSS=2329 php=2 phpRSS=347 ap=62 tcp=32 topuser=madalice 2026-08-19 02:55:33 L1=2.76 run=3 blk=0 avail=6475 (55.2%) swpO=1 conn=8 myRSS=2329 php=2 phpRSS=202 ap=58 tcp=36 topuser=madalice 2026-08-19 02:55:39 L1=2.62 run=6 blk=0 avail=6465 (55.1%) swpO=1 conn=3 myRSS=2329 php=2 phpRSS=256 ap=52 tcp=48 topuser=madalice 2026-08-19 02:55:43 L1=2.49 run=2 blk=0 avail=6546 (55.8%) swpO=0 conn=8 myRSS=2329 php=2 phpRSS=198 ap=48 tcp=39 topuser=madalice 2026-08-19 02:55:49 L1=2.29 run=2 blk=0 avail=6572 (56.0%) swpO=0 conn=3 myRSS=2329 php=1 phpRSS=190 ap=42 tcp=31 topuser=madalice 2026-08-19 02:55:53 L1=2.27 run=2 blk=0 avail=6566 (56.0%) swpO=0 conn=8 myRSS=2329 php=2 phpRSS=248 ap=38 tcp=30 topuser=madalice 2026-08-19 02:55:59 L1=2.17 run=6 blk=0 avail=6791 (57.9%) swpO=0 conn=3 myRSS=2329 php=0 phpRSS=0 ap=32 tcp=30 topuser=- 2026-08-19 02:56:03 L1=2.07 run=3 blk=0 avail=6590 (56.2%) swpO=0 conn=3 myRSS=2329 php=3 phpRSS=312 ap=28 tcp=31 topuser=madalice 2026-08-19 02:56:09 L1=1.99 run=1 blk=0 avail=6862 (58.5%) swpO=0 conn=3 myRSS=2329 php=0 phpRSS=0 ap=22 tcp=30 topuser=- 2026-08-19 02:56:13 L1=1.99 run=3 blk=0 avail=6694 (57.1%) swpO=0 conn=3 myRSS=2329 php=2 phpRSS=251 ap=18 tcp=29 topuser=olympic 2026-08-19 02:56:19 L1=1.91 run=2 blk=0 avail=6792 (57.9%) swpO=0 conn=2 myRSS=2329 php=1 phpRSS=129 ap=17 tcp=30 topuser=madalice 2026-08-19 02:56:23 L1=1.92 run=2 blk=0 avail=6766 (57.7%) swpO=0 conn=3 myRSS=2329 php=1 phpRSS=156 ap=17 tcp=31 topuser=madalice 2026-08-19 02:56:29 L1=1.76 run=2 blk=0 avail=6737 (57.4%) swpO=0 conn=2 myRSS=2329 php=1 phpRSS=185 ap=17 tcp=31 topuser=madalice 2026-08-19 02:56:33 L1=1.70 run=1 blk=0 avail=6890 (58.7%) swpO=0 conn=3 myRSS=2329 php=0 phpRSS=0 ap=17 tcp=29 topuser=- 2026-08-19 02:56:39 L1=1.64 run=2 blk=0 avail=6824 (58.2%) swpO=0 conn=2 myRSS=2329 php=1 phpRSS=66 ap=24 tcp=37 topuser=madalice 2026-08-19 02:56:43 L1=1.51 run=3 blk=0 avail=6779 (57.8%) swpO=0 conn=3 myRSS=2329 php=1 phpRSS=91 ap=26 tcp=52 topuser=madalice 2026-08-19 02:56:49 L1=1.47 run=2 blk=0 avail=6603 (56.3%) swpO=1 conn=2 myRSS=2329 php=2 phpRSS=138 ap=51 tcp=47 topuser=aaa 2026-08-19 02:56:53 L1=1.35 run=2 blk=0 avail=6640 (56.6%) swpO=1 conn=3 myRSS=2329 php=1 phpRSS=81 ap=48 tcp=34 topuser=madalice 2026-08-19 02:56:59 L1=1.32 run=2 blk=0 avail=6685 (57.0%) swpO=0 conn=2 myRSS=2329 php=1 phpRSS=81 ap=41 tcp=31 topuser=madalice 2026-08-19 02:57:03 L1=1.30 run=3 blk=0 avail=6606 (56.3%) swpO=0 conn=3 myRSS=2329 php=2 phpRSS=215 ap=38 tcp=31 topuser=madalice 2026-08-19 02:57:09 L1=1.43 run=6 blk=0 avail=6374 (54.3%) swpO=0 conn=2 myRSS=2329 php=4 phpRSS=545 ap=32 tcp=81 topuser=madalice 2026-08-19 02:57:13 L1=1.40 run=3 blk=0 avail=6536 (55.7%) swpO=0 conn=3 myRSS=2329 php=1 phpRSS=198 ap=46 tcp=82 topuser=madalice 2026-08-19 02:57:19 L1=1.53 run=6 blk=0 avail=5614 (47.9%) swpO=0 conn=8 myRSS=2330 php=7 phpRSS=1233 ap=57 tcp=36 topuser=madalice 2026-08-19 02:57:23 L1=1.57 run=2 blk=0 avail=6597 (56.2%) swpO=0 conn=3 myRSS=2330 php=2 phpRSS=100 ap=54 tcp=53 topuser=madalice 2026-08-19 02:57:29 L1=1.52 run=7 blk=0 avail=6334 (54.0%) swpO=0 conn=8 myRSS=2330 php=6 phpRSS=537 ap=47 tcp=38 topuser=madalice 2026-08-19 02:57:33 L1=1.56 run=3 blk=0 avail=6504 (55.5%) swpO=0 conn=3 myRSS=2330 php=2 phpRSS=267 ap=43 tcp=47 topuser=madalice 2026-08-19 02:57:40 L1=1.51 run=4 blk=0 avail=6562 (56.0%) swpO=0 conn=8 myRSS=2330 php=2 phpRSS=246 ap=37 tcp=46 topuser=alison 2026-08-19 02:57:43 L1=1.47 run=5 blk=0 avail=6499 (55.4%) swpO=0 conn=3 myRSS=2330 php=4 phpRSS=322 ap=44 tcp=116 topuser=madalice 2026-08-19 02:57:50 L1=1.84 run=22 blk=0 avail=4443 (37.9%) swpO=324 conn=15 myRSS=2322 php=16 phpRSS=2054 ap=153 tcp=144 topuser=madalice 2026-08-19 02:57:53 L1=3.29 run=9 blk=0 avail=5149 (43.9%) swpO=754 conn=3 myRSS=2311 php=5 phpRSS=947 ap=150 tcp=84 topuser=madalice