INCIDENT 2026-08-20 03:55:22 trigger: php_rss=1704MB ================================================================== load: 2.60 1.20 1.00 13/680 3345668 ncpu:10 mem_avail: 5142MB/11729MB (43.8%) swap_used:2336MB swapout:0/s blocked(D):0 running:14 iowait:0.1% steal:0.0% php: 12 procs / 1704MB heaviest user: madalice (9 procs, 1423MB) apache: 37 procs tcp_estab: 41 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2717 madalice 8 1308 root 250 965 nobody 35 579 netdata 8 257 customc 2 245 mailman 20 137 kurri 9 105 otterfencing 1 78 cpanellogin 1 69 dovenull 6 25 candyfabcom 2 23 mailnull 4 22 evolution 6 22 wp-toolkit 6 19 zabbix 1 15 named 1 15 aaa 1 12 nscd 1 7 dovecot 3 7 --- php workers by user --- USER PROCS RSS_MB madalice 8 1322 customc 2 249 otterfencing 1 78 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4558 MB Active(file): 3569 MB Inactive(file): 527 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 478 MB CommitLimit: 9960 MB Committed_AS: 8873 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3248642 root 02:44:06 10968 /usr/bin/imunify-agent-proxy 3335617 root 17:21 3108 /bin/bash /etc/cron.daily/imunify-antivirus.cron 3335618 root 17:21 1252 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 3335619 root 17:21 7900 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 3335630 root 17:21 14832 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 3345348 root 00:22 1332 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2782452 10.6 Ssl 4-20:04:46 /usr/sbin/mariadbd 3345628 3342334 madalice 269380 81.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 206504 2.5 Ssl 51-17:45:28 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3298114 3290507 root 186068 0.0 S 01:19:47 spamd child 3290507 1 root 173300 0.0 Ss 01:32:36 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3298115 3290507 root 165576 0.0 S 01:19:47 spamd child 3345631 3345040 customc 158992 67.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3345632 3343149 madalice 147900 116 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3345633 3343785 madalice 132188 102 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3345634 3344742 madalice 118156 102 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3345645 3345524 customc 114440 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3345636 3345601 madalice 102164 86.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3345635 3345520 madalice 92236 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3345637 3345590 otterfencing 85884 56.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3141574 1353308 cpanellogin 70760 0.0 S 03:55:13 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 2575382 1 root 63108 0.0 Ss 4-20:04:49 /usr/lib/systemd/systemd-journald 2223 1201 root 47904 0.0 Sl 51-17:45:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 35960 0.0 Ss 29-01:13:58 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33496 0.1 Sl 51-17:45:23 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3289952 1 root 31640 0.0 Ss 01:33:09 lfd - sleeping 3345626 3342336 madalice 28984 84.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 27204 0.1 Ss 51-17:45:27 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 26352 0.0 Ss 51-17:45:27 tailwatchd 3343138 1276780 nobody 22508 0.0 S 04:14 /usr/sbin/httpd -k start 3342844 1276780 nobody 22244 0.0 S 04:59 /usr/sbin/httpd -k start 3342334 1276780 nobody 22208 0.0 R 05:55 /usr/sbin/httpd -k start 3343149 1276780 nobody 22020 0.0 S 04:13 /usr/sbin/httpd -k start 3343785 1276780 nobody 21880 0.0 S 02:59 /usr/sbin/httpd -k start 3343137 1276780 nobody 21580 0.0 S 04:14 /usr/sbin/httpd -k start 3342336 1276780 nobody 21180 0.0 S 05:54 /usr/sbin/httpd -k start 3344533 1276780 nobody 21048 0.0 S 02:13 /usr/sbin/httpd -k start 3344742 1276780 nobody 20688 0.1 S 01:44 /usr/sbin/httpd -k start 3344807 1276780 nobody 20136 0.1 S 01:38 /usr/sbin/httpd -k start 3344874 1276780 nobody 19660 0.0 S 01:24 /usr/sbin/httpd -k start 3344960 1276780 nobody 19548 0.1 S 01:19 /usr/sbin/httpd -k start 3344529 1276780 nobody 19544 0.0 S 02:16 /usr/sbin/httpd -k start 3345559 1276780 nobody 19244 0.3 S 00:10 /usr/sbin/httpd -k start 3345040 1276780 nobody 19232 0.0 S 01:05 /usr/sbin/httpd -k start 3345558 1276780 nobody 19160 0.3 S 00:10 /usr/sbin/httpd -k start 3345041 1276780 nobody 18288 0.0 S 01:05 /usr/sbin/httpd -k start 185104 2431 netdata 17108 2.1 Sl 7-07:21:46 /usr/libexec/netdata/plugins.d/apps.plugin 1 3345601 1276780 nobody 16900 0.0 S 00:07 /usr/sbin/httpd -k start 3345527 1276780 nobody 16736 0.0 S 00:11 /usr/sbin/httpd -k start 3333939 1471 root 16672 0.0 S 20:44 cPhulkd - dbprocessor 3345606 1276780 nobody 16668 0.0 S 00:06 /usr/sbin/httpd -k start 3345524 1276780 nobody 16612 0.0 S 00:11 /usr/sbin/httpd -k start 1204 1 zabbix 16300 0.2 Ssl 51-17:45:28 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3345526 1276780 nobody 16256 0.0 S 00:11 /usr/sbin/httpd -k start 3345557 1276780 nobody 16256 0.0 S 00:10 /usr/sbin/httpd -k start 3345520 1276780 nobody 16252 0.0 S 00:12 /usr/sbin/httpd -k start 3345525 1276780 nobody 16244 0.0 S 00:11 /usr/sbin/httpd -k start 3345553 1276780 nobody 16232 0.0 S 00:10 /usr/sbin/httpd -k start 3345555 1276780 nobody 16196 0.0 S 00:10 /usr/sbin/httpd -k start 3345556 1276780 nobody 16188 0.0 S 00:10 /usr/sbin/httpd -k start 3345552 1276780 nobody 16132 0.0 S 00:10 /usr/sbin/httpd -k start 3345554 1276780 nobody 16124 0.0 S 00:10 /usr/sbin/httpd -k start 2107664 1 named 16080 0.0 Ssl 1-01:32:42 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1471 1 root 15676 0.0 Ss 51-17:45:27 cPhulkd - processor 3335630 3335619 root 14832 0.0 SN 17:21 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 3345590 1276780 nobody 13636 0.1 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14538290 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 56 evolution/portal.evolutionerp.com.au-ssl_log 21 corpkicks/corporatekicks.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 1 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 38 20.250.13.23 21 203.54.180.238 15 35.231.42.202 2 118.127.40.55 1 66.249.73.167 1 66.249.73.165 1 49.65.18.19 1 40.77.167.8 1 34.196.51.17 1 2a03:2880:f802:3f:: 1 180.102.110.177 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 2 POST /wp-cron.php 2 GET /wp-blog-header.php 1 POST / 1 HEAD / 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /xmlrpc.php 1 GET /wp.php 1 GET /wp-json 1 GET /wp-includes/phpmailer/phpmailer.php 1 GET /wp-content/themes/test.php 1 GET /wp-content/themes/panel.php 1 GET /wp-content/themes/config.php 1 GET /wp-content/languages/wp-blog-header.php 1 GET /wp-content/languages/plugins/config.php 1 GET /wp-content/data.php 1 GET /wp-config-sample.php 1 GET /wp-admin.php 1 GET /users.php 1 GET /upload/medialibrary --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /wp-blog-header.php 1 POST / 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /xmlrpc.php 1 GET /wp.php 1 GET /wp-json 1 GET /wp-includes/phpmailer/phpmailer.php 1 GET /wp-content/themes/test.php 1 GET /wp-content/themes/panel.php 1 GET /wp-content/themes/config.php 1 GET /wp-content/languages/wp-blog-header.php 1 GET /wp-content/languages/plugins/config.php -- last 10 requests -- 35.231.42.202 - - [20/Aug/2026:03:55:09 +1000] "GET /.git/HEAD HTTP/1.1" 404 30550 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:11 +1000] "GET /.git-credentials HTTP/1.1" 404 30553 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:10 +1000] "GET /.git/config HTTP/1.1" 404 30552 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:14 +1000] "GET /.env HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:14 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:14 +1000] "GET /.env.example HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:14 +1000] "GET /.env.backup HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:14 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:15 +1000] "GET /api/.env HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.231.42.202 - - [20/Aug/2026:03:55:15 +1000] "GET /admin/.env HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 21 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [20/Aug/2026:03:53:52 +1000] "GET /heartbeat.php?sentAt=1787162033&bytes=106,133,237,177&_=1787115833070 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:01 +1000] "GET /heartbeat.php?sentAt=1787162041&bytes=106,133,237,185&_=1787143288995 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:02 +1000] "GET /heartbeat.php?sentAt=1787162043&bytes=106,133,237,187&_=1787115833071 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:11 +1000] "GET /heartbeat.php?sentAt=1787162051&bytes=106,133,237,195&_=1787143288996 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:12 +1000] "GET /heartbeat.php?sentAt=1787162053&bytes=106,133,237,197&_=1787115833072 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:21 +1000] "GET /heartbeat.php?sentAt=1787162061&bytes=106,133,237,205&_=1787143288997 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:22 +1000] "GET /heartbeat.php?sentAt=1787162063&bytes=106,133,237,207&_=1787115833073 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:31 +1000] "GET /heartbeat.php?sentAt=1787162071&bytes=106,133,237,215&_=1787143288998 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:32 +1000] "GET /heartbeat.php?sentAt=1787162073&bytes=106,133,237,217&_=1787115833074 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [20/Aug/2026:03:54:41 +1000] "GET /heartbeat.php?sentAt=1787162081&bytes=106,133,237,225&_=1787143288999 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 1 HEAD / 1 GET / -- last 10 requests -- 34.196.51.17 - - [20/Aug/2026:03:53:09 +1000] "HEAD / HTTP/1.1" 200 - "https://corporatekicks.com.au/" "WPMUDEV Uptime Monitor 5.0 (https://wpmudev.com)" 118.127.40.55 - - [20/Aug/2026:03:53:10 +1000] "POST /wp-cron.php?doing_wp_cron=1787161990.6535758972167968750000 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://corporatekicks.com.au" 49.65.18.19 - - [20/Aug/2026:03:53:56 +1000] "GET / HTTP/1.1" 200 25646 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)" 118.127.40.55 - - [20/Aug/2026:03:53:57 +1000] "POST /wp-cron.php?doing_wp_cron=1787162037.9495019912719726562500 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://corporatekicks.com.au" --- last 30 samples (run-up to this incident) --- 2026-08-20 03:53:01 L1=0.33 run=1 blk=0 avail=6587 (56.2%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=39 ap=15 tcp=30 topuser=evolution 2026-08-20 03:53:02 L1=0.33 run=1 blk=0 avail=6600 (56.3%) swpO=0 conn=1 myRSS=2732 php=0 phpRSS=0 ap=15 tcp=30 topuser=- 2026-08-20 03:53:11 L1=0.58 run=4 blk=0 avail=6251 (53.3%) swpO=0 conn=2 myRSS=2732 php=2 phpRSS=269 ap=17 tcp=29 topuser=corpkicks 2026-08-20 03:53:12 L1=0.58 run=1 blk=0 avail=6583 (56.1%) swpO=0 conn=1 myRSS=2732 php=0 phpRSS=0 ap=17 tcp=28 topuser=- 2026-08-20 03:53:21 L1=0.49 run=1 blk=0 avail=6599 (56.3%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=39 ap=14 tcp=26 topuser=evolution 2026-08-20 03:53:22 L1=0.49 run=1 blk=0 avail=6611 (56.4%) swpO=0 conn=1 myRSS=2732 php=0 phpRSS=0 ap=14 tcp=26 topuser=- 2026-08-20 03:53:31 L1=0.50 run=3 blk=0 avail=6381 (54.4%) swpO=0 conn=2 myRSS=2732 php=2 phpRSS=296 ap=14 tcp=28 topuser=madalice 2026-08-20 03:53:32 L1=0.50 run=2 blk=0 avail=6585 (56.1%) swpO=0 conn=1 myRSS=2732 php=1 phpRSS=55 ap=14 tcp=32 topuser=madalice 2026-08-20 03:53:41 L1=0.50 run=2 blk=0 avail=6494 (55.4%) swpO=0 conn=2 myRSS=2732 php=2 phpRSS=172 ap=15 tcp=33 topuser=madalice 2026-08-20 03:53:42 L1=0.50 run=3 blk=0 avail=6449 (55.0%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=189 ap=15 tcp=32 topuser=madalice 2026-08-20 03:53:51 L1=0.65 run=3 blk=0 avail=6527 (55.6%) swpO=0 conn=2 myRSS=2732 php=2 phpRSS=130 ap=16 tcp=30 topuser=madalice 2026-08-20 03:53:52 L1=0.65 run=2 blk=0 avail=6483 (55.3%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=143 ap=16 tcp=31 topuser=madalice 2026-08-20 03:54:02 L1=0.71 run=2 blk=0 avail=6478 (55.2%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=39 ap=18 tcp=35 topuser=evolution 2026-08-20 03:54:02 L1=0.71 run=2 blk=0 avail=6535 (55.7%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=68 ap=18 tcp=36 topuser=madalice 2026-08-20 03:54:12 L1=0.67 run=3 blk=0 avail=6420 (54.7%) swpO=0 conn=2 myRSS=2732 php=2 phpRSS=214 ap=18 tcp=31 topuser=madalice 2026-08-20 03:54:12 L1=0.67 run=2 blk=0 avail=6357 (54.2%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=254 ap=18 tcp=30 topuser=madalice 2026-08-20 03:54:22 L1=0.95 run=2 blk=0 avail=6500 (55.4%) swpO=0 conn=3 myRSS=2732 php=2 phpRSS=110 ap=21 tcp=31 topuser=madalice 2026-08-20 03:54:22 L1=0.95 run=2 blk=0 avail=6460 (55.1%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=122 ap=21 tcp=31 topuser=madalice 2026-08-20 03:54:32 L1=0.96 run=2 blk=0 avail=6359 (54.2%) swpO=0 conn=3 myRSS=2732 php=2 phpRSS=248 ap=21 tcp=33 topuser=madalice 2026-08-20 03:54:32 L1=0.96 run=2 blk=0 avail=6487 (55.3%) swpO=0 conn=2 myRSS=2732 php=1 phpRSS=97 ap=21 tcp=33 topuser=otterfencing 2026-08-20 03:54:42 L1=1.19 run=3 blk=0 avail=6374 (54.3%) swpO=0 conn=3 myRSS=2732 php=2 phpRSS=228 ap=20 tcp=33 topuser=madalice 2026-08-20 03:54:42 L1=1.19 run=5 blk=0 avail=6238 (53.2%) swpO=0 conn=4 myRSS=2732 php=3 phpRSS=402 ap=20 tcp=34 topuser=madalice 2026-08-20 03:54:52 L1=1.32 run=7 blk=0 avail=6462 (55.1%) swpO=0 conn=3 myRSS=2732 php=2 phpRSS=159 ap=19 tcp=31 topuser=madalice 2026-08-20 03:54:52 L1=1.32 run=6 blk=0 avail=6343 (54.1%) swpO=0 conn=4 myRSS=2732 php=3 phpRSS=303 ap=19 tcp=32 topuser=madalice 2026-08-20 03:55:02 L1=1.34 run=3 blk=0 avail=6461 (55.1%) swpO=1 conn=3 myRSS=2732 php=1 phpRSS=112 ap=19 tcp=31 topuser=otterfencing 2026-08-20 03:55:02 L1=1.34 run=3 blk=0 avail=6334 (54.0%) swpO=1 conn=4 myRSS=2732 php=3 phpRSS=274 ap=19 tcp=32 topuser=otterfencing 2026-08-20 03:55:12 L1=2.17 run=8 blk=0 avail=5590 (47.7%) swpO=561 conn=3 myRSS=2717 php=6 phpRSS=1104 ap=25 tcp=42 topuser=madalice 2026-08-20 03:55:12 L1=2.17 run=5 blk=0 avail=5897 (50.3%) swpO=561 conn=4 myRSS=2717 php=5 phpRSS=703 ap=33 tcp=45 topuser=madalice 2026-08-20 03:55:22 L1=2.60 run=14 blk=0 avail=5142 (43.8%) swpO=0 conn=12 myRSS=2717 php=12 phpRSS=1704 ap=37 tcp=41 topuser=madalice 2026-08-20 03:55:23 L1=2.60 run=11 blk=0 avail=5590 (47.7%) swpO=0 conn=4 myRSS=2717 php=9 phpRSS=1103 ap=36 tcp=42 topuser=madalice