INCIDENT 2026-08-22 01:54:25 trigger: swapout=2866/s php_procs=53 php_rss=6052MB mysql_conn=51 ================================================================== load: 30.23 10.00 4.64 56/738 1324648 ncpu:10 mem_avail: 1662MB/11729MB (14.2%) swap_used:3811MB swapout:2866/s blocked(D):1 running:61 iowait:1.1% steal:0.0% php: 53 procs / 6052MB heaviest user: alison (48 procs, 5661MB) apache: 75 procs tcp_estab: 73 --- RSS by user (all processes) --- USER PROCS RSS_MB alison 46 5500 mysql 1 2546 root 246 1037 nobody 74 996 tubesupplies 3 256 netdata 8 237 cpanellogin 1 98 mailman 20 92 aaa 2 73 kurri 3 35 evolution 8 27 dovenull 6 26 infinium 2 24 wp-toolkit 6 19 mailnull 3 17 zabbix 1 15 named 1 11 nscd 1 7 dovecot 3 6 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB alison 44 5459 tubesupplies 3 256 root 1 87 aaa 1 60 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4104 MB Active(file): 934 MB Inactive(file): 417 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 399 MB CommitLimit: 9960 MB Committed_AS: 16081 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 43:09 6280 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2607808 11.2 Ssl 6-18:03:50 /usr/sbin/mariadbd 1220 1 netdata 186380 2.5 Ssl 53-15:44:32 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1297184 1297182 root 177244 0.5 S 43:24 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 319521 311538 root 176228 0.0 S 23:16:41 spamd child 1324501 1323140 alison 162780 15.4 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324485 1324202 alison 158412 18.6 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324493 1322197 alison 157440 16.6 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324524 1324028 alison 156828 16.6 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324590 1324588 alison 153884 38.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324480 1323352 alison 152700 18.5 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324505 1323322 alison 152392 14.4 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324508 1324194 alison 149300 16.1 S 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324518 1323103 alison 147844 18.8 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324517 1323292 alison 147020 14.2 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324525 1324188 alison 146100 14.0 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324523 1321652 alison 145996 17.0 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324484 1323133 alison 144236 13.3 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324488 1322207 alison 143780 14.7 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324502 1323293 alison 142356 15.4 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324510 1316891 alison 141488 16.0 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324494 1323161 alison 140764 18.5 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324483 1323101 alison 139464 17.0 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324520 1324192 alison 138376 16.3 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324489 1324193 alison 134924 13.8 S 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324486 1323294 alison 134240 15.4 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324519 1324209 alison 131816 13.6 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324534 1323158 alison 131280 16.4 R 00:07 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324513 1323104 alison 131132 16.4 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324509 1324046 alison 131032 13.7 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324522 1323162 alison 129864 13.7 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324482 1323872 alison 127588 14.4 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324498 1323295 alison 125556 16.0 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324504 1323286 alison 124828 15.1 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324511 1323160 alison 124236 13.7 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324515 1318185 alison 122344 15.6 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324490 1323157 alison 121912 11.4 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324506 1323142 alison 120768 13.5 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324492 1324013 alison 119696 15.6 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324491 1324040 alison 117500 14.3 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324499 1324203 alison 113288 12.3 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 111564 0.0 Ss 6-18:03:53 /usr/lib/systemd/systemd-journald 1324512 1323163 alison 111184 12.2 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324500 1322978 alison 104184 11.2 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324536 1324205 tubesupplies 103336 13.4 R 00:07 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258448 1353308 cpanellogin 100396 0.0 S 01:42:12 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1324537 1324516 tubesupplies 98620 12.2 R 00:07 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324591 1324044 alison 94656 19.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324581 1324574 alison 93244 17.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324589 1324587 alison 93104 17.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1298247 1297184 root 89640 96.6 R 42:05 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/evolution 311538 1 root 83508 0.0 Ss 23:31:40 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 853881 311538 root 80896 0.0 S 12:03:36 spamd child 1324571 1322215 alison 79164 14.0 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324592 1324531 alison 78388 21.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324593 1323285 tubesupplies 74120 11.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1324614 1324594 aaa 61808 34.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 44028 0.0 Sl 53-15:44:31 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41048 0.0 Ss 30-23:13:02 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 32120 0.1 Sl 53-15:44:27 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1250570 1 root 30244 0.0 Ss 01:54:24 lfd - sleeping --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23010152 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 413 infinium/infinium.net.au-ssl_log 91 otter2/otterfencing.net.au 44 bigdeals/bigdeals.com.au-ssl_log 33 evolution/portal.evolutionerp.com.au-ssl_log 21 madalice/madalice.com.au-ssl_log 7 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 378 34.158.52.41 91 172.161.79.158 44 20.29.77.16 33 20.169.16.7 30 118.127.40.55 21 203.54.180.238 2 121.229.156.18 2 114.119.134.10 2 114.119.131.88 1 66.249.73.171 1 52.167.144.146 1 35.170.205.140 1 223.109.252.226 1 114.119.146.16 1 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 33 GET /autodiscover/autodiscover.xml 32 POST / 27 GET /fetch 21 GET /heartbeat.php 8 GET /proxy 4 GET / 3 GET /store/peep-af1/ 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /wp-mail.php 2 GET /wp-login.php 2 GET /wp-admin/ 2 GET /webhook 2 GET /test.php 2 GET /screenshot 2 GET /redirect 2 GET /preview 2 GET /pms 2 GET /manager.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 32 POST / 27 GET /fetch 8 GET /proxy 4 GET / 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /webhook 2 GET /screenshot 2 GET /redirect 2 GET /preview 2 GET /pms -- last 10 requests -- 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /config/application.properties HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /actuator/heapdump HTTP/1.1" 404 49417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /dump.sql HTTP/1.1" 404 49531 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /horizon/dashboard HTTP/1.1" 404 49417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 118.127.40.55 - - [22/Aug/2026:01:54:21 +1000] "POST /?wordfence_syncAttackData=1787327660.8313 HTTP/1.1" 200 13718 "-" "WordPress/7.1; https://alisonarts.com.au" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /wp-config.php.bak HTTP/1.1" 404 49417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /config/database.yml HTTP/1.1" 404 49417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /db.sql HTTP/1.1" 404 49531 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /config/application.yml HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.158.52.41 - - [22/Aug/2026:01:54:17 +1000] "GET /application-prod.properties HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" == infinium/infinium.net.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/fonts/ -- last 10 requests -- 172.161.79.158 - - [22/Aug/2026:01:53:00 +1000] "GET /sagax1.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:00 +1000] "GET /wpc.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:01 +1000] "GET /fone1.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:01 +1000] "GET /ncx.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:01 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:02 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:02 +1000] "GET /zup.php73 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:02 +1000] "GET /k.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:03 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:01:53:03 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == otter2/otterfencing.net.au == -- top paths -- 1 GET /yup.php 1 GET /xx.php 1 GET /xa.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-mt.php 1 GET /wp-mail.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-configs.php 1 GET /wp-add.php 1 GET /we2.php 1 GET /user.php -- last 10 requests -- 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /file5.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /k.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /file18.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /filemanager.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:18 +1000] "GET /xa.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /alfa.php HTTP/1.1" 403 13 "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /save.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /baxa1.phP8 HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /av.php HTTP/1.1" 404 - "-" "-" 20.29.77.16 - - [22/Aug/2026:01:53:19 +1000] "GET /blue.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 01:51:51 L1=1.70 run=5 blk=0 avail=6521 (55.6%) swpO=0 conn=2 myRSS=2679 php=1 phpRSS=89 ap=16 tcp=21 topuser=root 2026-08-22 01:52:01 L1=1.67 run=3 blk=0 avail=6529 (55.7%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:01 L1=1.67 run=4 blk=0 avail=6529 (55.7%) swpO=0 conn=2 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:11 L1=1.57 run=4 blk=0 avail=6524 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=25 topuser=root 2026-08-22 01:52:11 L1=1.57 run=3 blk=0 avail=6524 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=25 topuser=root 2026-08-22 01:52:21 L1=1.63 run=2 blk=0 avail=6542 (55.8%) swpO=1 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:21 L1=1.63 run=3 blk=0 avail=6540 (55.8%) swpO=1 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=24 topuser=root 2026-08-22 01:52:31 L1=1.62 run=2 blk=0 avail=6538 (55.7%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=26 topuser=root 2026-08-22 01:52:31 L1=1.62 run=3 blk=0 avail=6536 (55.7%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=15 tcp=26 topuser=root 2026-08-22 01:52:41 L1=1.68 run=2 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=24 topuser=root 2026-08-22 01:52:41 L1=1.68 run=4 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=24 topuser=root 2026-08-22 01:52:51 L1=1.58 run=2 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=23 topuser=root 2026-08-22 01:52:51 L1=1.58 run=3 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2680 php=1 phpRSS=89 ap=16 tcp=23 topuser=root 2026-08-22 01:53:02 L1=1.49 run=6 blk=0 avail=6127 (52.2%) swpO=0 conn=1 myRSS=2680 php=8 phpRSS=684 ap=17 tcp=65 topuser=alison 2026-08-22 01:53:02 L1=1.49 run=7 blk=0 avail=6123 (52.2%) swpO=0 conn=1 myRSS=2680 php=8 phpRSS=691 ap=17 tcp=65 topuser=alison 2026-08-22 01:53:12 L1=2.05 run=13 blk=1 avail=5750 (49.0%) swpO=167 conn=9 myRSS=2675 php=9 phpRSS=907 ap=46 tcp=69 topuser=alison 2026-08-22 01:53:12 L1=2.05 run=16 blk=1 avail=5743 (49.0%) swpO=167 conn=1 myRSS=2675 php=17 phpRSS=1076 ap=50 tcp=69 topuser=alison 2026-08-22 01:53:22 L1=4.50 run=43 blk=0 avail=3688 (31.4%) swpO=778 conn=40 myRSS=2650 php=42 phpRSS=3928 ap=52 tcp=68 topuser=alison 2026-08-22 01:53:22 L1=4.50 run=43 blk=0 avail=3661 (31.2%) swpO=778 conn=40 myRSS=2649 php=42 phpRSS=3987 ap=53 tcp=61 topuser=alison 2026-08-22 01:53:33 L1=10.99 run=18 blk=1 avail=5308 (45.3%) swpO=3283 conn=12 myRSS=2604 php=13 phpRSS=1536 ap=53 tcp=42 topuser=alison 2026-08-22 01:53:37 L1=12.19 run=27 blk=0 avail=4748 (40.5%) swpO=2408 conn=21 myRSS=2604 php=22 phpRSS=2393 ap=51 tcp=52 topuser=alison 2026-08-22 01:53:43 L1=12.74 run=41 blk=0 avail=5095 (43.4%) swpO=0 conn=19 myRSS=2604 php=35 phpRSS=2360 ap=49 tcp=84 topuser=alison 2026-08-22 01:53:48 L1=15.32 run=46 blk=0 avail=3318 (28.3%) swpO=0 conn=42 myRSS=2604 php=43 phpRSS=4383 ap=61 tcp=69 topuser=alison 2026-08-22 01:53:54 L1=15.86 run=52 blk=0 avail=5235 (44.6%) swpO=0 conn=10 myRSS=2604 php=46 phpRSS=2620 ap=56 tcp=82 topuser=alison 2026-08-22 01:53:58 L1=18.59 run=55 blk=0 avail=3060 (26.1%) swpO=0 conn=45 myRSS=2604 php=48 phpRSS=4685 ap=70 tcp=75 topuser=alison 2026-08-22 01:54:04 L1=21.67 run=13 blk=0 avail=5503 (46.9%) swpO=2909 conn=7 myRSS=2585 php=11 phpRSS=1327 ap=65 tcp=29 topuser=alison 2026-08-22 01:54:09 L1=23.78 run=47 blk=1 avail=4210 (35.9%) swpO=2645 conn=41 myRSS=2585 php=43 phpRSS=3496 ap=64 tcp=76 topuser=alison 2026-08-22 01:54:14 L1=25.24 run=20 blk=0 avail=4363 (37.2%) swpO=0 conn=15 myRSS=2585 php=20 phpRSS=2407 ap=60 tcp=43 topuser=alison 2026-08-22 01:54:19 L1=27.38 run=52 blk=0 avail=4111 (35.1%) swpO=0 conn=49 myRSS=2585 php=50 phpRSS=3807 ap=60 tcp=77 topuser=alison 2026-08-22 01:54:25 L1=30.23 run=61 blk=1 avail=1662 (14.2%) swpO=2866 conn=51 myRSS=2546 php=53 phpRSS=6052 ap=75 tcp=73 topuser=alison