INCIDENT 2026-08-20 02:03:48 trigger: php_rss=1803MB mysql_conn=15 ================================================================== load: 6.93 2.27 1.19 16/702 3278770 ncpu:10 mem_avail: 5020MB/11729MB (42.8%) swap_used:2462MB swapout:0/s blocked(D):0 running:22 iowait:0.2% steal:0.0% php: 17 procs / 1803MB heaviest user: olympic (10 procs, 1037MB) apache: 71 procs tcp_estab: 41 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2755 nobody 70 1075 olympic 8 823 root 246 728 madalice 5 615 netdata 8 259 evolution 8 239 mailman 20 140 cpanellogin 1 64 kurri 5 57 dovenull 6 26 lowrange 2 24 wp-toolkit 6 19 zabbix 1 16 named 1 15 aaa 1 12 alison 1 10 nscd 1 7 mailnull 1 6 dovecot 3 6 --- php workers by user --- USER PROCS RSS_MB olympic 8 839 madalice 5 624 evolution 2 220 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4874 MB Active(file): 3395 MB Inactive(file): 944 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 609 MB CommitLimit: 9960 MB Committed_AS: 9889 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3248642 root 52:32 11468 /usr/bin/imunify-agent-proxy 3276195 root 03:48 3104 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2821348 10.7 Ssl 4-18:13:12 /usr/sbin/mariadbd 1220 1 netdata 208520 2.5 Ssl 51-15:53:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3278714 3278568 madalice 201160 50.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278724 3277904 madalice 166492 99.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278716 3278631 madalice 163884 44.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278722 3277922 olympic 151448 51.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2661802 2112450 root 148388 0.0 S 12:49:33 spamd child 3278738 3277923 evolution 137620 70.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3278729 3277926 olympic 132468 78.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278735 3278567 olympic 126724 106 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278732 3278592 evolution 125520 31.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2575382 1 root 118900 0.0 Ss 4-18:13:15 /usr/lib/systemd/systemd-journald 3278733 3278556 olympic 91976 45.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278739 3277918 madalice 83976 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278741 3277845 olympic 79392 60.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278740 3278655 madalice 74612 30.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3278736 3277912 olympic 69436 58.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3141574 1353308 cpanellogin 66056 0.0 S 02:03:39 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 2112450 1 root 62936 0.0 Ss 23:40:16 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3255140 2112450 root 61480 0.0 S 43:02 spamd child 2223 1201 root 45064 0.0 Sl 51-15:53:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41064 0.0 Ss 28-23:22:24 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 32976 0.1 Sl 51-15:53:49 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3141466 1 root 30788 0.0 Ss 02:03:47 lfd - sleeping 1469 1 root 28076 0.1 Ss 51-15:53:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3271111 1276780 nobody 23068 0.0 S 13:23 /usr/sbin/httpd -k start 3277866 1276780 nobody 19564 0.0 S 01:14 /usr/sbin/httpd -k start 3277912 1276780 nobody 19476 0.0 S 01:11 /usr/sbin/httpd -k start 3277845 1276780 nobody 19464 0.0 S 01:17 /usr/sbin/httpd -k start 3277850 1276780 nobody 19364 0.0 S 01:16 /usr/sbin/httpd -k start 3277928 1276780 nobody 19296 0.0 S 01:11 /usr/sbin/httpd -k start 3277904 1276780 nobody 19216 0.0 S 01:11 /usr/sbin/httpd -k start 3277886 1276780 nobody 19120 0.0 S 01:12 /usr/sbin/httpd -k start 3277922 1276780 nobody 19104 0.0 S 01:11 /usr/sbin/httpd -k start 3277905 1276780 nobody 19092 0.0 S 01:11 /usr/sbin/httpd -k start 3277897 1276780 nobody 19028 0.0 S 01:11 /usr/sbin/httpd -k start 3278571 1276780 nobody 19028 0.0 S 00:14 /usr/sbin/httpd -k start 3277923 1276780 nobody 18840 0.0 S 01:11 /usr/sbin/httpd -k start 3278567 1276780 nobody 18476 1.2 S 00:14 /usr/sbin/httpd -k start 3278533 1276780 nobody 18348 0.1 S 00:17 /usr/sbin/httpd -k start 3278541 1276780 nobody 18332 0.0 S 00:16 /usr/sbin/httpd -k start 3278555 1276780 nobody 18228 0.1 S 00:15 /usr/sbin/httpd -k start 3277589 1276780 nobody 18192 0.0 S 01:46 /usr/sbin/httpd -k start 3278633 1276780 nobody 18100 0.0 S 00:09 /usr/sbin/httpd -k start 3278634 1276780 nobody 17864 0.0 S 00:09 /usr/sbin/httpd -k start 3275795 1276780 nobody 17836 0.0 S 04:47 /usr/sbin/httpd -k start 3278619 1276780 nobody 17772 0.0 S 00:10 /usr/sbin/httpd -k start 3278556 1276780 nobody 17704 0.0 S 00:15 /usr/sbin/httpd -k start 3277879 1276780 nobody 17552 0.0 S 01:12 /usr/sbin/httpd -k start 3277898 1276780 nobody 17516 0.0 S 01:11 /usr/sbin/httpd -k start 3277961 1276780 nobody 17480 0.0 S 01:09 /usr/sbin/httpd -k start 3277914 1276780 nobody 17408 0.0 S 01:11 /usr/sbin/httpd -k start 3278631 1276780 nobody 17372 0.0 S 00:09 /usr/sbin/httpd -k start 3277919 1276780 nobody 17148 0.0 S 01:11 /usr/sbin/httpd -k start 185104 2431 netdata 17080 2.1 Sl 7-05:30:12 /usr/libexec/netdata/plugins.d/apps.plugin 1 1463 1 root 16908 0.0 Ss 51-15:53:53 tailwatchd 3277907 1276780 nobody 16860 0.0 S 01:11 /usr/sbin/httpd -k start 3278654 1276780 nobody 16796 0.0 S 00:08 /usr/sbin/httpd -k start 3277891 1276780 nobody 16792 0.0 R 01:12 /usr/sbin/httpd -k start 3277908 1276780 nobody 16784 0.0 S 01:11 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14530043 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olympic/olympicfencing.com.au-ssl_log 363 infinium/infinium.net.au-ssl_log 95 aaa/aaadownunder.com.au-ssl_log 60 evolution/portal.evolutionerp.com.au-ssl_log 27 madalice/madalice.com.au-ssl_log 13 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 382 34.87.94.53 95 172.161.79.158 56 52.139.47.57 27 203.54.180.238 4 118.127.40.55 2 91.92.243.249 2 43.167.236.228 2 2a02:842b:6f20:3101:fd6c:6888:6037:acd1 2 112.86.225.230 1 54.39.6.214 1 52.3.102.51 1 52.204.89.12 1 34.226.89.140 1 34.199.252.22 1 3.220.148.166 --- top request paths across all vhosts (last 3 min) --- 52 GET /fetch 27 GET /heartbeat.php 13 GET /proxy 9 GET / 6 GET /@fs/proc/self/environ 5 GET /read 4 POST /wp-cron.php 4 GET /webhook 4 GET /redirect 4 GET /preview 4 GET /image 4 GET /@fs/proc/1/environ 4 GET /@fs/etc/passwd 4 GET /api/webhook 4 GET /api/v1/fetch 4 GET /api/proxy 4 GET /api/preview 4 GET /api/image 4 GET /api/fetch 3 GET /.env --- busiest 3 vhosts: top paths + last 10 requests --- == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 52 GET /fetch 13 GET /proxy 6 GET /@fs/proc/self/environ 5 GET /read 4 GET /webhook 4 GET /redirect 4 GET /preview 4 GET /image 4 GET /@fs/proc/1/environ 4 GET /@fs/etc/passwd 4 GET /api/webhook 4 GET /api/v1/fetch -- last 10 requests -- 34.87.94.53 - - [20/Aug/2026:02:03:49 +1000] "GET /conf/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.87.94.53 - - [20/Aug/2026:02:03:49 +1000] "GET /old/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.87.94.53 - - [20/Aug/2026:02:03:49 +1000] "GET /backup/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.87.94.53 - - [20/Aug/2026:02:03:49 +1000] "GET /apps/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.87.94.53 - - [20/Aug/2026:02:03:49 +1000] "GET /crm/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.87.94.53 - - [20/Aug/2026:02:03:49 +1000] "GET /html/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.87.94.53 - - [20/Aug/2026:02:03:49 +1000] "GET /application/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.87.94.53 - - [20/Aug/2026:02:03:50 +1000] "GET /.docker/.env HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.87.94.53 - - [20/Aug/2026:02:03:50 +1000] "GET /v2/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.87.94.53 - - [20/Aug/2026:02:03:50 +1000] "GET /v1/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" == infinium/infinium.net.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php -- last 10 requests -- 172.161.79.158 - - [20/Aug/2026:02:02:36 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:36 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:36 +1000] "GET /zup.php73 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:36 +1000] "GET /k.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:37 +1000] "GET /wp-blink.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:37 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:37 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:38 +1000] "GET /wp-content/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:38 +1000] "GET /ww5.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [20/Aug/2026:02:02:38 +1000] "GET /2.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 POST /wp-login.php 2 POST /wp-cron.php 1 GET /xor_create.php 1 GET /wp-trackback.php 1 GET /wp-signin.php 1 GET /wp-includes/11.php 1 GET /wp-config.php 1 GET /wp-admin/js/gk.php 1 GET /wp-admin/js/fi.php 1 GET /wp-admin/css 1 GET /.well-known/s1.php 1 GET /.well-known/11.php -- last 10 requests -- 52.139.47.57 - - [20/Aug/2026:02:03:07 +1000] "GET /uploads/upload.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:07 +1000] "GET /wp-admin/js/fi.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:07 +1000] "GET /images/contato.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:07 +1000] "GET /wp-admin/js/gk.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:08 +1000] "GET /admin/function.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:08 +1000] "GET /images/iupload.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:08 +1000] "GET /index/function.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:08 +1000] "GET /uploads/mailer.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:09 +1000] "GET /wp-includes/11.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.47.57 - - [20/Aug/2026:02:03:09 +1000] "GET /.well-known/11.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-20 02:01:20 L1=0.35 run=2 blk=0 avail=6594 (56.2%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=14 tcp=25 topuser=- 2026-08-20 02:01:27 L1=0.40 run=2 blk=0 avail=6584 (56.1%) swpO=0 conn=2 myRSS=2754 php=1 phpRSS=133 ap=14 tcp=25 topuser=madalice 2026-08-20 02:01:30 L1=0.37 run=2 blk=0 avail=6628 (56.5%) swpO=0 conn=1 myRSS=2754 php=1 phpRSS=91 ap=14 tcp=23 topuser=madalice 2026-08-20 02:01:37 L1=0.34 run=1 blk=0 avail=6685 (57.0%) swpO=0 conn=2 myRSS=2754 php=0 phpRSS=0 ap=14 tcp=24 topuser=- 2026-08-20 02:01:40 L1=0.31 run=1 blk=0 avail=6683 (57.0%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-20 02:01:47 L1=0.29 run=1 blk=0 avail=6684 (57.0%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=14 tcp=24 topuser=- 2026-08-20 02:01:50 L1=0.26 run=1 blk=0 avail=6681 (57.0%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-20 02:01:58 L1=0.24 run=2 blk=0 avail=6627 (56.5%) swpO=0 conn=1 myRSS=2754 php=1 phpRSS=89 ap=14 tcp=24 topuser=madalice 2026-08-20 02:02:00 L1=0.30 run=1 blk=0 avail=6684 (57.0%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-20 02:02:08 L1=0.36 run=3 blk=0 avail=6557 (55.9%) swpO=0 conn=1 myRSS=2754 php=1 phpRSS=146 ap=16 tcp=24 topuser=alison 2026-08-20 02:02:10 L1=0.33 run=1 blk=0 avail=6674 (56.9%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-20 02:02:18 L1=0.30 run=2 blk=0 avail=6601 (56.3%) swpO=0 conn=1 myRSS=2754 php=1 phpRSS=92 ap=16 tcp=24 topuser=corpkicks 2026-08-20 02:02:21 L1=0.28 run=1 blk=0 avail=6659 (56.8%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-20 02:02:28 L1=0.34 run=1 blk=0 avail=6662 (56.8%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-20 02:02:31 L1=0.31 run=1 blk=0 avail=6656 (56.7%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-20 02:02:38 L1=0.29 run=1 blk=0 avail=6220 (53.0%) swpO=0 conn=1 myRSS=2754 php=1 phpRSS=40 ap=79 tcp=85 topuser=evolution 2026-08-20 02:02:41 L1=0.42 run=3 blk=0 avail=6024 (51.4%) swpO=0 conn=1 myRSS=2754 php=2 phpRSS=254 ap=80 tcp=84 topuser=madalice 2026-08-20 02:02:48 L1=0.39 run=1 blk=0 avail=6261 (53.4%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=74 tcp=23 topuser=- 2026-08-20 02:02:51 L1=0.36 run=1 blk=0 avail=6279 (53.5%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=71 tcp=22 topuser=- 2026-08-20 02:02:58 L1=0.41 run=1 blk=0 avail=6328 (54.0%) swpO=0 conn=1 myRSS=2754 php=0 phpRSS=0 ap=64 tcp=23 topuser=- 2026-08-20 02:03:01 L1=0.54 run=14 blk=0 avail=5425 (46.3%) swpO=0 conn=1 myRSS=2754 php=12 phpRSS=1270 ap=61 tcp=36 topuser=olympic 2026-08-20 02:03:08 L1=1.61 run=14 blk=0 avail=5740 (48.9%) swpO=0 conn=1 myRSS=2755 php=9 phpRSS=935 ap=54 tcp=37 topuser=olympic 2026-08-20 02:03:11 L1=2.13 run=8 blk=0 avail=5966 (50.9%) swpO=0 conn=8 myRSS=2755 php=7 phpRSS=659 ap=51 tcp=39 topuser=olympic 2026-08-20 02:03:18 L1=3.16 run=14 blk=0 avail=5828 (49.7%) swpO=0 conn=1 myRSS=2755 php=11 phpRSS=1007 ap=44 tcp=37 topuser=olympic 2026-08-20 02:03:21 L1=3.79 run=23 blk=0 avail=5945 (50.7%) swpO=0 conn=8 myRSS=2755 php=11 phpRSS=877 ap=41 tcp=38 topuser=olympic 2026-08-20 02:03:28 L1=4.60 run=11 blk=0 avail=5936 (50.6%) swpO=0 conn=1 myRSS=2755 php=7 phpRSS=790 ap=34 tcp=34 topuser=olympic 2026-08-20 02:03:31 L1=5.36 run=15 blk=0 avail=5870 (50.0%) swpO=0 conn=8 myRSS=2755 php=14 phpRSS=1089 ap=31 tcp=42 topuser=olympic 2026-08-20 02:03:38 L1=6.77 run=14 blk=0 avail=5735 (48.9%) swpO=0 conn=1 myRSS=2755 php=11 phpRSS=907 ap=49 tcp=73 topuser=olympic 2026-08-20 02:03:41 L1=6.23 run=23 blk=0 avail=5621 (47.9%) swpO=0 conn=8 myRSS=2755 php=16 phpRSS=1255 ap=77 tcp=70 topuser=olympic 2026-08-20 02:03:48 L1=6.93 run=22 blk=0 avail=5020 (42.8%) swpO=0 conn=15 myRSS=2755 php=17 phpRSS=1803 ap=71 tcp=41 topuser=olympic