INCIDENT 2026-08-21 22:15:01 trigger: swapout=3457/s ================================================================== load: 2.10 1.32 1.17 6/666 1188476 ncpu:10 mem_avail: 3443MB/11729MB (29.4%) swap_used:3217MB swapout:3457/s blocked(D):4 running:15 iowait:7.6% steal:0.0% php: 4 procs / 408MB heaviest user: madalice (1 procs, 149MB) apache: 17 procs tcp_estab: 22 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 18 2898 mysql 1 2789 root 267 1065 nobody 16 278 netdata 8 247 alison 2 159 madalice 1 149 mailman 20 94 aaa 2 91 cpanellogin 1 85 dovenull 6 26 kurri 2 22 wp-toolkit 6 17 zabbix 1 15 named 1 10 nscd 1 7 dovecot 3 7 mailnull 1 5 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 1 150 alison 1 148 aaa 1 80 evolution 1 56 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3313 MB Active(file): 1546 MB Inactive(file): 1619 MB Dirty: 385 MB Writeback: 38 MB SReclaimable: 399 MB CommitLimit: 9960 MB Committed_AS: 10184 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 21:03:45 2516 /usr/bin/imunify-agent-proxy 1164866 root 15:01 1228 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1186540 root 02:15 51792 /opt/imunify360/venv/bin/python3 /usr/bin/imunify360-agent update --force 1186547 root 02:14 60660 /opt/imunify360/venv/bin/python3 -m imav.run 1188399 root 00:01 3292 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2856192 11.4 Ssl 6-14:24:26 /usr/sbin/mariadbd 1188307 1188306 evolution 2818876 83.6 RNs 00:14 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 1220 1 netdata 194472 2.5 Ssl 53-12:05:08 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 319521 311538 root 181936 0.0 S 19:37:17 spamd child 1188383 1170645 madalice 154356 33.5 D 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1188387 1186959 alison 152132 57.5 D 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 853881 311538 root 118236 0.0 S 08:24:12 spamd child 311538 1 root 94232 0.0 Ss 19:52:16 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1188389 1170659 aaa 89812 58.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1147543 1353308 cpanellogin 87856 0.0 S 42:31 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 1186237 2223 root 71716 0.6 Sl 02:17 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager ProcessPayload(jid=2026082112124 1188423 1188395 evolution 67096 16.0 Ds 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1186547 1 root 60660 4.2 Dsl 02:14 /opt/imunify360/venv/bin/python3 -m imav.run 1186540 1186237 root 51792 0.2 S 02:15 /opt/imunify360/venv/bin/python3 /usr/bin/imunify360-agent update --force 1186577 2111368 root 43260 0.6 SN 02:12 cpanellogd - waiting for child to process logs for evolution 2223 1201 root 41976 0.0 Sl 53-12:05:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1188227 1186577 evolution 41784 0.2 SN 00:18 cpanellogd - http logs for evolution 1353308 1 root 40948 0.0 Ss 30-19:33:38 cpsrvd (SSL) - waiting for connections 2575382 1 root 37352 0.0 Ss 6-14:24:29 /usr/lib/systemd/systemd-journald 4922 2431 netdata 32600 0.1 Sl 53-12:05:03 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 29132 0.1 Ss 53-12:05:07 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1170654 1276780 nobody 23440 0.1 S 05:52 /usr/sbin/httpd -k start 1167198 1276780 nobody 23176 0.0 S 11:36 /usr/sbin/httpd -k start 1170645 1276780 nobody 21592 0.0 S 05:53 /usr/sbin/httpd -k start 1186959 1276780 nobody 21552 0.1 S 01:42 /usr/sbin/httpd -k start 310731 1 root 20856 0.0 Ss 19:52:48 lfd - sleeping 1170655 1276780 nobody 20252 0.0 S 05:52 /usr/sbin/httpd -k start 1170659 1276780 nobody 20200 0.1 S 05:52 /usr/sbin/httpd -k start 1186986 1276780 nobody 20188 0.0 S 01:41 /usr/sbin/httpd -k start 1188390 310731 root 19520 0.0 D 00:01 lfd - child closing 1186904 1276780 nobody 19096 0.1 S 01:50 /usr/sbin/httpd -k start 1186958 1276780 nobody 18968 0.0 S 01:42 /usr/sbin/httpd -k start 1187749 1276780 nobody 18816 0.0 S 00:47 /usr/sbin/httpd -k start 1186985 1276780 nobody 18752 0.0 S 01:41 /usr/sbin/httpd -k start 1187000 1276780 nobody 18688 0.0 S 01:40 /usr/sbin/httpd -k start 1463 1 root 18544 0.0 Ss 53-12:05:07 tailwatchd 1186998 1276780 nobody 18348 0.0 S 01:40 /usr/sbin/httpd -k start 1188436 1188434 root 18068 3.0 S 00:01 /usr/local/cpanel/bin/dcpumon 185104 2431 netdata 17716 2.1 Sl 9-01:41:26 /usr/libexec/netdata/plugins.d/apps.plugin 1 1187642 1276780 nobody 17008 0.0 S 00:54 /usr/sbin/httpd -k start 1204 1 zabbix 16080 0.2 Ssl 53-12:05:08 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1187181 3828812 aaa 12532 0.0 S 01:20 dovecot/imap 1154829 3828812 kurri 12508 0.0 S 30:01 dovecot/imap 1169541 3828812 alison 12132 0.0 S 07:39 dovecot/imap 1276780 1 root 11964 0.0 Ss 16-06:43:43 /usr/sbin/httpd -k start 405204 1471 root 11956 0.0 S 17:03:51 cPhulkd - dbprocessor 1188466 1188464 evolution 11644 0.0 S 00:00 /usr/local/cpanel/3rdparty/libexec/git-core/git-remote-https origin https://git-codecommit.ap-southeast-2.amazonaws.com/v1/repos/portal 1188483 1188482 evolution 11612 0.0 S 00:00 /usr/local/cpanel/3rdparty/libexec/git-core/git-remote-https origin https://git-codecommit.ap-southeast-2.amazonaws.com/v1/repos/evolut 1471 1 root 11000 0.0 Ss 53-12:05:07 cPhulkd - processor 1186839 3828812 root 10952 0.0 S 01:55 dovecot/auth -w 3668761 3828812 kurri 10828 0.0 S 1-12:00:47 dovecot/imap 2107664 1 named 10800 0.0 Ssl 2-19:52:22 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1188421 1188418 root 9908 3.0 D 00:01 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/bin/dbindex 2107879 1 root 9128 0.0 Ss 2-19:52:21 queueprocd - waiting up to 60s to process a task 918817 27524 root 8900 0.0 Ss 07:01:04 sshd: evolution [priv] 1059098 3828812 dovenull 8096 0.0 S 8-06:42:13 dovecot/imap-login 1466 1 root 7732 0.0 Ss 53-12:05:07 dnsadmin - dormant mode 1059102 3828812 dovenull 7428 0.0 S 8-06:42:13 dovecot/imap-login 2111078 1 nscd 7232 0.0 Ssl 2-19:52:11 /usr/sbin/nscd 1188429 1188422 root 7108 2.0 S 00:01 /usr/bin/perl /root/dnsexport.pl --- processes in D state (uninterruptible IO) --- 121 D - [kswapd0] 1002887 D - [kworker/u256:3+flush-8:0] 1186547 Dsl - /opt/imunify360/venv/bin/python3 -m imav.run 1188383 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1188423 Ds - /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 22972228 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olytis/tis.com.au-ssl_log 76 aaa/aaadownunder.com.au-ssl_log 70 olympic/olympicfencing.com.au-ssl_log 43 madalice/madalice.com.au-ssl_log 41 evolution/portal.evolutionerp.com.au-ssl_log 22 alison/alisonarts.com.au-ssl_log 15 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 76 172.182.200.96 66 91.92.42.71 43 172.212.194.58 34 52.139.47.57 22 203.54.180.238 13 74.7.227.151 3 14.201.15.11 2 118.127.40.55 2 114.119.143.14 1 74.7.228.46 1 54.176.66.62 1 2405:6e00:492:5581:74e6:c195:f5fd:2d34 1 209.141.34.121 1 121.229.156.32 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 67 POST /wp-login.php 22 GET /heartbeat.php 4 GET / 2 POST /wp-cron.php 2 GET /xmlrpc.php 2 GET /wp-login.php 2 GET /wp-head.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /store/haha-hand-painted-af1-shoes/ 1 POST / 1 GET /Zoo.php 1 GET /zoko.php 1 GET /xwx1.php 1 GET /xrp.php 1 GET /xr.php 1 GET /xp.php 1 GET /xingkong/index.php 1 GET /xex.php 1 GET /xd.php --- busiest 3 vhosts: top paths + last 10 requests --- == olytis/tis.com.au-ssl_log == -- top paths -- 1 GET /wp-login.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/js/dist/alfa-rex.php7 1 GET /wp-includes/fonts/about.php 1 GET /wp-head.php 1 GET /wp-content/themes/xss/about.php7 1 GET /wp-content/themes/sketch/404.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/plugins/cp-pro/js.php 1 GET /wp-admin/YpWD4kv2sPG.php 1 GET /wp-admin/YkUJz1cAtjd.php 1 GET /wp-admin/wQdN5HnvEtR.php -- last 10 requests -- 172.182.200.96 - - [21/Aug/2026:22:14:11 +1000] "GET /wp-admin/ACKuJTcsdkq.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:12 +1000] "GET /wp-admin/5svPkCuORXp.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:12 +1000] "GET /wp-includes/fonts/about.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:12 +1000] "GET /wp-admin/UZirInCNFYQ.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:13 +1000] "GET /wp-admin/5Rfz2ZsDC6r.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:13 +1000] "GET /wp-admin/E1wf7ZgCrni.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:13 +1000] "GET /wp-login.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:14 +1000] "GET /wp-admin/2QRfdFOJN78.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:14 +1000] "GET /wp-admin/p1BbHnzr2lS.php HTTP/1.1" 404 5750 "-" "-" 172.182.200.96 - - [21/Aug/2026:22:14:14 +1000] "GET /wp-admin/v1Cd9rWaZMx.php HTTP/1.1" 404 5750 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 67 POST /wp-login.php 2 POST /wp-cron.php 1 GET /index.php/2021/10/ -- last 10 requests -- 91.92.42.71 - - [21/Aug/2026:22:14:39 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [21/Aug/2026:22:14:41 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [21/Aug/2026:22:14:43 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [21/Aug/2026:22:14:44 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [21/Aug/2026:22:14:46 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [21/Aug/2026:22:14:48 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [21/Aug/2026:22:14:49 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 118.127.40.55 - - [21/Aug/2026:22:14:52 +1000] "POST /wp-cron.php?doing_wp_cron=1787314492.5243899822235107421875 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://aaadownunder.com.au" 91.92.42.71 - - [21/Aug/2026:22:14:51 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [21/Aug/2026:22:14:56 +1000] "POST /wp-login.php HTTP/1.1" 200 7299 "https://www.aafps.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 1 GET /Zoo.php 1 GET /zoko.php 1 GET /xwx1.php 1 GET /xrp.php 1 GET /xr.php 1 GET /xp.php 1 GET /xmlrpc.php 1 GET /xingkong/index.php 1 GET /xex.php 1 GET /xd.php 1 GET /wyzer1.php 1 GET /wtiiy.php -- last 10 requests -- 172.212.194.58 - - [21/Aug/2026:22:14:46 +1000] "GET /wp-content/radio.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:47 +1000] "GET /Zoo.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:47 +1000] "GET /wp-sing.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:48 +1000] "GET /wp-content/1.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:48 +1000] "GET /wp-content/plugin.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:48 +1000] "GET /vct.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:49 +1000] "GET /wp-content/w.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:49 +1000] "GET /wper3.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:49 +1000] "GET /likesample.php HTTP/1.1" 404 5749 "-" "-" 172.212.194.58 - - [21/Aug/2026:22:14:50 +1000] "GET /ws78.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-21 22:12:37 L1=1.29 run=1 blk=0 avail=6495 (55.4%) swpO=0 conn=1 myRSS=2905 php=1 phpRSS=41 ap=18 tcp=22 topuser=aaa 2026-08-21 22:12:41 L1=1.18 run=3 blk=0 avail=6405 (54.6%) swpO=0 conn=4 myRSS=2905 php=3 phpRSS=194 ap=18 tcp=21 topuser=aaa 2026-08-21 22:12:47 L1=1.17 run=2 blk=0 avail=6466 (55.1%) swpO=0 conn=1 myRSS=2905 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-21 22:12:51 L1=1.24 run=3 blk=1 avail=6317 (53.9%) swpO=0 conn=4 myRSS=2905 php=2 phpRSS=87 ap=17 tcp=20 topuser=aaa 2026-08-21 22:12:57 L1=1.30 run=3 blk=0 avail=6350 (54.1%) swpO=0 conn=1 myRSS=2905 php=1 phpRSS=40 ap=15 tcp=19 topuser=evolution 2026-08-21 22:13:01 L1=1.27 run=2 blk=0 avail=6317 (53.9%) swpO=0 conn=4 myRSS=2905 php=2 phpRSS=81 ap=15 tcp=24 topuser=evolution 2026-08-21 22:13:07 L1=1.17 run=3 blk=0 avail=6073 (51.8%) swpO=0 conn=4 myRSS=2905 php=3 phpRSS=359 ap=15 tcp=26 topuser=madalice 2026-08-21 22:13:11 L1=1.32 run=3 blk=1 avail=5958 (50.8%) swpO=2 conn=4 myRSS=2906 php=4 phpRSS=532 ap=15 tcp=28 topuser=corpkicks 2026-08-21 22:13:17 L1=1.21 run=2 blk=0 avail=6172 (52.6%) swpO=2 conn=4 myRSS=2906 php=2 phpRSS=242 ap=17 tcp=22 topuser=madalice 2026-08-21 22:13:21 L1=1.19 run=2 blk=0 avail=6070 (51.8%) swpO=0 conn=4 myRSS=2906 php=0 phpRSS=0 ap=20 tcp=38 topuser=- 2026-08-21 22:13:27 L1=1.34 run=2 blk=0 avail=5544 (47.3%) swpO=0 conn=4 myRSS=2906 php=2 phpRSS=79 ap=30 tcp=33 topuser=evolution 2026-08-21 22:13:31 L1=1.31 run=3 blk=0 avail=6202 (52.9%) swpO=0 conn=4 myRSS=2906 php=3 phpRSS=176 ap=28 tcp=22 topuser=aaa 2026-08-21 22:13:37 L1=1.21 run=1 blk=1 avail=6318 (53.9%) swpO=0 conn=4 myRSS=2906 php=1 phpRSS=39 ap=22 tcp=23 topuser=evolution 2026-08-21 22:13:41 L1=1.35 run=2 blk=0 avail=6322 (53.9%) swpO=0 conn=2 myRSS=2906 php=1 phpRSS=40 ap=20 tcp=24 topuser=evolution 2026-08-21 22:13:47 L1=1.32 run=2 blk=0 avail=6351 (54.2%) swpO=0 conn=4 myRSS=2906 php=1 phpRSS=40 ap=16 tcp=24 topuser=evolution 2026-08-21 22:13:51 L1=1.30 run=2 blk=0 avail=6334 (54.0%) swpO=0 conn=2 myRSS=2906 php=2 phpRSS=88 ap=16 tcp=26 topuser=aaa 2026-08-21 22:13:57 L1=1.43 run=5 blk=1 avail=6193 (52.8%) swpO=0 conn=4 myRSS=2906 php=3 phpRSS=146 ap=16 tcp=29 topuser=aaa 2026-08-21 22:14:01 L1=1.40 run=3 blk=0 avail=6281 (53.6%) swpO=0 conn=2 myRSS=2906 php=2 phpRSS=126 ap=16 tcp=27 topuser=aaa 2026-08-21 22:14:07 L1=1.45 run=1 blk=1 avail=6343 (54.1%) swpO=0 conn=2 myRSS=2906 php=2 phpRSS=80 ap=16 tcp=26 topuser=evolution 2026-08-21 22:14:11 L1=1.41 run=2 blk=0 avail=6297 (53.7%) swpO=0 conn=2 myRSS=2906 php=2 phpRSS=117 ap=17 tcp=27 topuser=aaa 2026-08-21 22:14:17 L1=1.46 run=3 blk=0 avail=6289 (53.6%) swpO=1 conn=2 myRSS=2905 php=2 phpRSS=115 ap=18 tcp=30 topuser=alison 2026-08-21 22:14:21 L1=1.42 run=2 blk=0 avail=6190 (52.8%) swpO=1 conn=2 myRSS=2905 php=2 phpRSS=215 ap=18 tcp=29 topuser=madalice 2026-08-21 22:14:28 L1=1.47 run=3 blk=0 avail=6314 (53.8%) swpO=1 conn=2 myRSS=2905 php=2 phpRSS=102 ap=18 tcp=22 topuser=aaa 2026-08-21 22:14:31 L1=1.35 run=2 blk=0 avail=6284 (53.6%) swpO=1 conn=2 myRSS=2906 php=2 phpRSS=139 ap=17 tcp=23 topuser=otterfencing 2026-08-21 22:14:38 L1=1.40 run=6 blk=0 avail=6103 (52.0%) swpO=0 conn=2 myRSS=2906 php=4 phpRSS=225 ap=17 tcp=25 topuser=alison 2026-08-21 22:14:41 L1=1.53 run=6 blk=0 avail=6135 (52.3%) swpO=0 conn=4 myRSS=2906 php=3 phpRSS=310 ap=17 tcp=26 topuser=madalice 2026-08-21 22:14:48 L1=1.57 run=3 blk=0 avail=6312 (53.8%) swpO=0 conn=2 myRSS=2906 php=3 phpRSS=121 ap=17 tcp=24 topuser=alison 2026-08-21 22:14:51 L1=1.92 run=10 blk=6 avail=5562 (47.4%) swpO=269 conn=4 myRSS=2897 php=1 phpRSS=48 ap=17 tcp=24 topuser=aaa 2026-08-21 22:14:58 L1=1.93 run=3 blk=0 avail=3881 (33.1%) swpO=1697 conn=2 myRSS=2860 php=2 phpRSS=96 ap=17 tcp=21 topuser=aaa 2026-08-21 22:15:01 L1=2.10 run=15 blk=4 avail=3443 (29.4%) swpO=3457 conn=5 myRSS=2799 php=4 phpRSS=408 ap=17 tcp=22 topuser=madalice