INCIDENT 2026-08-22 01:53:22 trigger: php_procs=42 php_rss=3928MB mysql_conn=40 ================================================================== load: 7.74 3.15 2.25 61/710 1323440 ncpu:10 mem_avail: 3688MB/11729MB (31.4%) swap_used:3471MB swapout:778/s blocked(D):0 running:43 iowait:0.2% steal:0.0% php: 42 procs / 3928MB heaviest user: alison (41 procs, 3840MB) apache: 52 procs tcp_estab: 68 --- RSS by user (all processes) --- USER PROCS RSS_MB alison 42 4110 mysql 1 2638 root 247 1050 nobody 52 820 netdata 8 248 cpanellogin 1 117 mailman 20 93 kurri 3 35 evolution 8 28 dovenull 6 26 mailnull 4 24 infinium 2 24 wp-toolkit 6 19 zabbix 1 16 aaa 1 13 named 1 11 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB alison 43 4194 root 1 87 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4367 MB Active(file): 2296 MB Inactive(file): 578 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 620 MB CommitLimit: 9960 MB Committed_AS: 14523 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 42:06 7956 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2695368 11.2 Ssl 6-18:02:48 /usr/sbin/mariadbd 1220 1 netdata 196640 2.5 Ssl 53-15:43:30 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 319521 311538 root 178464 0.0 S 23:15:39 spamd child 1297184 1297182 root 178364 0.6 S 42:22 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 1323346 1323295 alison 140904 34.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323324 1323132 alison 135932 21.0 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323327 1323159 alison 135208 29.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323326 1323294 alison 133012 27.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323332 1322979 alison 132628 31.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323345 1322197 alison 132428 27.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323330 1323292 alison 125436 30.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323331 1322978 alison 125124 26.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323335 1323285 alison 123276 21.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323338 1322976 alison 123144 22.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323325 1323163 alison 121384 19.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323351 1316891 alison 120412 25.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258448 1353308 cpanellogin 120084 0.0 S 01:41:10 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1323328 1322215 alison 118544 20.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323342 1323141 alison 118396 25.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323336 1323143 alison 117204 28.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323329 1323140 alison 116296 22.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323349 1323102 alison 116240 22.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323337 1315849 alison 114176 19.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323333 1318185 alison 112748 22.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323339 1323101 alison 112720 20.2 S 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323334 1323104 alison 112048 20.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 111576 0.0 Ss 6-18:02:51 /usr/lib/systemd/systemd-journald 1323347 1323103 alison 111348 20.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323341 1322207 alison 111216 26.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323343 1323142 alison 111060 22.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323340 1323108 alison 110440 20.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323359 1323106 alison 107248 37.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323344 1322977 alison 104788 17.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323348 1323293 alison 91180 17.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1298247 1297184 root 89944 98.0 R 41:03 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/evolution 311538 1 root 86280 0.0 Ss 23:30:38 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1323358 1323157 alison 85640 17.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 853881 311538 root 82860 0.0 S 12:02:34 spamd child 1323364 1323352 alison 79516 19.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323376 1323133 alison 79148 42.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323370 1322684 alison 78360 22.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323371 1322966 alison 75340 16.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323350 1323162 alison 74640 21.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323361 1322965 alison 74416 26.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323367 1323286 alison 74284 19.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323373 1323322 alison 71160 18.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323377 1323164 alison 70616 28.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323366 1323353 alison 70004 20.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323383 1321652 alison 55032 7.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1323446 1323105 alison 46828 7.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 44528 0.0 Sl 53-15:43:29 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1323418 1323160 alison 43752 4.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42544 0.0 Ss 30-23:12:00 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33416 0.1 Sl 53-15:43:25 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1250570 1 root 32852 0.0 Ss 01:53:22 lfd - sleeping 1469 1 root 25188 0.1 Ss 53-15:43:29 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1318185 1276780 nobody 22384 0.0 S 07:48 /usr/sbin/httpd -k start 1315849 1276780 nobody 21668 0.0 S 11:16 /usr/sbin/httpd -k start 1316891 1276780 nobody 20072 0.0 S 09:48 /usr/sbin/httpd -k start 1322215 1276780 nobody 19940 0.0 S 01:56 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23009823 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 194 infinium/infinium.net.au-ssl_log 96 otter2/otterfencing.net.au 44 evolution/portal.evolutionerp.com.au-ssl_log 21 madalice/madalice.com.au-ssl_log 6 customc/customcentral.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 155 34.158.52.41 91 172.161.79.158 51 20.75.92.165 44 20.29.77.16 21 203.54.180.238 7 91.92.241.196 3 112.82.218.177 2 121.229.156.18 2 114.119.134.10 2 114.119.130.169 1 223.109.252.226 1 223.109.252.201 1 118.127.40.55 1 114.119.140.234 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 21 GET /fetch 6 GET /.git/HEAD 5 GET / 3 GET /read 3 GET /.git/config 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /xx.php 2 GET /x.php 2 GET /wp-mail.php 2 GET /we2.php 2 GET /vx.php 2 GET /store/pink-barbie-af1s/ 2 GET /manager.php 2 GET /k.php 2 GET /info.php 2 GET /goods.php 2 GET /gallery/tattoo-fatboy/ 2 GET /@fs/root/.aws/credentials --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 21 GET /fetch 4 GET / 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /gallery/tattoo-fatboy/ 2 GET /@fs/root/.aws/credentials 2 GET /@fs/proc/1/environ 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /@fs/etc/passwd 1 POST /v1/graphql 1 POST /graphql/console -- last 10 requests -- 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /Jenkinsfile HTTP/1.1" 404 49417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /jenkins/config.xml HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.158.52.41 - - [22/Aug/2026:01:53:19 +1000] "GET /proxy?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/am 34.158.52.41 - - [22/Aug/2026:01:53:19 +1000] "GET /fetch?src=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Finfo HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/b 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /.github/workflows/docker.yml HTTP/1.1" 404 49417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /bitbucket-pipelines.yml HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /config/jenkins.conf HTTP/1.1" 404 49417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /azure-pipelines.yml HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /jenkins/Jenkinsfile HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.158.52.41 - - [22/Aug/2026:01:53:18 +1000] "GET /jenkins/secrets/master.key HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" == infinium/infinium.net.au-ssl_log == -- top paths -- 2 GET /.git/HEAD 2 GET /.git/config 1 POST /wp-cron.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php -- last 10 requests -- 172.161.79.158 - - [22/Aug/2026:01:53:00 +1000] "GET /sagax1.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:00 +1000] "GET /wpc.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:01 +1000] "GET /fone1.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:01 +1000] "GET /ncx.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:01 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:02 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:02 +1000] "GET /zup.php73 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:02 +1000] "GET /k.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:03 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:03 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == otter2/otterfencing.net.au == -- top paths -- 1 GET /yup.php 1 GET /xx.php 1 GET /xa.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-mt.php 1 GET /wp-mail.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-configs.php 1 GET /wp-add.php 1 GET /we2.php 1 GET /user.php -- last 10 requests -- 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /file5.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /k.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /file18.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /filemanager.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /xa.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /alfa.php HTTP/1.1" 403 13 "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /save.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /baxa1.phP8 HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /av.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /blue.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 01:51:01 L1=1.83 run=2 blk=0 avail=6495 (55.4%) swpO=3 conn=3 myRSS=2679 php=2 phpRSS=129 ap=19 tcp=25 topuser=root 2026-08-22 01:51:01 L1=1.83 run=6 blk=0 avail=6495 (55.4%) swpO=3 conn=2 myRSS=2679 php=2 phpRSS=129 ap=19 tcp=25 topuser=root 2026-08-22 01:51:11 L1=1.70 run=5 blk=0 avail=6482 (55.3%) swpO=0 conn=2 myRSS=2679 php=3 phpRSS=169 ap=19 tcp=27 topuser=root 2026-08-22 01:51:11 L1=1.70 run=2 blk=0 avail=6486 (55.3%) swpO=0 conn=2 myRSS=2679 php=3 phpRSS=154 ap=19 tcp=27 topuser=root 2026-08-22 01:51:21 L1=1.75 run=3 blk=0 avail=6457 (55.1%) swpO=1 conn=2 myRSS=2679 php=2 phpRSS=147 ap=19 tcp=27 topuser=root 2026-08-22 01:51:21 L1=1.75 run=5 blk=0 avail=6467 (55.1%) swpO=1 conn=2 myRSS=2679 php=2 phpRSS=148 ap=19 tcp=27 topuser=root 2026-08-22 01:51:31 L1=1.87 run=3 blk=0 avail=6295 (53.7%) swpO=0 conn=2 myRSS=2679 php=2 phpRSS=307 ap=22 tcp=29 topuser=madalice 2026-08-22 01:51:31 L1=1.87 run=4 blk=0 avail=6289 (53.6%) swpO=0 conn=2 myRSS=2679 php=2 phpRSS=310 ap=22 tcp=29 topuser=madalice 2026-08-22 01:51:41 L1=1.74 run=3 blk=0 avail=6497 (55.4%) swpO=0 conn=2 myRSS=2679 php=1 phpRSS=89 ap=20 tcp=23 topuser=root 2026-08-22 01:51:41 L1=1.74 run=3 blk=0 avail=6497 (55.4%) swpO=0 conn=2 myRSS=2679 php=1 phpRSS=89 ap=20 tcp=23 topuser=root 2026-08-22 01:51:51 L1=1.70 run=2 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2679 php=1 phpRSS=89 ap=16 tcp=21 topuser=root 2026-08-22 01:51:51 L1=1.70 run=5 blk=0 avail=6521 (55.6%) swpO=0 conn=2 myRSS=2679 php=1 phpRSS=89 ap=16 tcp=21 topuser=root 2026-08-22 01:52:01 L1=1.67 run=3 blk=0 avail=6529 (55.7%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:01 L1=1.67 run=4 blk=0 avail=6529 (55.7%) swpO=0 conn=2 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:11 L1=1.57 run=4 blk=0 avail=6524 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=25 topuser=root 2026-08-22 01:52:11 L1=1.57 run=3 blk=0 avail=6524 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=25 topuser=root 2026-08-22 01:52:21 L1=1.63 run=2 blk=0 avail=6542 (55.8%) swpO=1 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:21 L1=1.63 run=3 blk=0 avail=6540 (55.8%) swpO=1 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:31 L1=1.62 run=2 blk=0 avail=6538 (55.7%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=26 topuser=root 2026-08-22 01:52:31 L1=1.62 run=3 blk=0 avail=6536 (55.7%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=26 topuser=root 2026-08-22 01:52:41 L1=1.68 run=2 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=24 topuser=root 2026-08-22 01:52:41 L1=1.68 run=4 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=24 topuser=root 2026-08-22 01:52:51 L1=1.58 run=2 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=23 topuser=root 2026-08-22 01:52:51 L1=1.58 run=3 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=23 topuser=root 2026-08-22 01:53:02 L1=1.49 run=6 blk=0 avail=6127 (52.2%) swpO=0 conn=1 myRSS=2680 php=8 phpRSS=684 ap=17 tcp=65 topuser=alison 2026-08-22 01:53:02 L1=1.49 run=7 blk=0 avail=6123 (52.2%) swpO=0 conn=1 myRSS=2680 php=8 phpRSS=691 ap=17 tcp=65 topuser=alison 2026-08-22 01:53:12 L1=2.05 run=13 blk=1 avail=5750 (49.0%) swpO=167 conn=9 myRSS=2675 php=9 phpRSS=907 ap=46 tcp=69 topuser=alison 2026-08-22 01:53:12 L1=2.05 run=16 blk=1 avail=5743 (49.0%) swpO=167 conn=1 myRSS=2675 php=17 phpRSS=1076 ap=50 tcp=69 topuser=alison 2026-08-22 01:53:22 L1=4.50 run=43 blk=0 avail=3688 (31.4%) swpO=778 conn=40 myRSS=2650 php=42 phpRSS=3928 ap=52 tcp=68 topuser=alison 2026-08-22 01:53:22 L1=4.50 run=43 blk=0 avail=3661 (31.2%) swpO=778 conn=40 myRSS=2649 php=42 phpRSS=3987 ap=53 tcp=61 topuser=alison