INCIDENT 2026-08-22 02:53:14 trigger: swapout=2551/s php_rss=2066MB ================================================================== load: 3.35 1.97 2.02 40/686 1362723 ncpu:10 mem_avail: 5312MB/11729MB (45.3%) swap_used:3450MB swapout:2551/s blocked(D):1 running:23 iowait:0.6% steal:0.0% php: 20 procs / 2066MB heaviest user: madalice (19 procs, 1995MB) apache: 48 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 31 2641 mysql 1 2475 root 243 1156 nobody 46 752 netdata 8 255 mailman 20 94 cpanellogin 1 63 kurri 3 35 evolution 8 27 dovenull 6 26 infinium 2 23 wp-toolkit 6 19 zabbix 1 15 aaa 1 13 named 1 11 nscd 1 7 dovecot 3 7 corpkicks 1 7 mailnull 1 5 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 31 2697 root 1 71 corpkicks 1 7 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4289 MB Active(file): 2961 MB Inactive(file): 917 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 806 MB CommitLimit: 9960 MB Committed_AS: 12381 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 01:41:59 2724 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2534804 11.2 Ssl 6-19:02:40 /usr/sbin/mariadbd 1362641 1362630 madalice 270048 47.6 S 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362660 1359871 madalice 201444 52.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 200524 2.5 Ssl 53-16:43:22 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1343371 1 root 175948 0.2 Ss 29:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353013 1343371 root 169996 0.0 S 14:53 spamd child 1297184 1297182 root 169780 0.2 S 01:42:14 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 1353014 1343371 root 168444 0.0 S 14:53 spamd child 1362668 1362626 madalice 139364 58.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362666 1362617 madalice 137004 53.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362665 1362614 madalice 136456 55.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362664 1362615 madalice 133800 52.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362661 1362651 madalice 121752 61.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362670 1362631 madalice 82720 46.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362671 1362627 madalice 81328 41.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362669 1359885 madalice 77052 18.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362681 1362655 madalice 76500 34.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1341953 1297184 root 72908 98.7 R 31:11 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/nrg 1362689 1356127 madalice 70644 37.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362675 1362653 madalice 68588 25.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362677 1362648 madalice 68472 22.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362672 1362650 madalice 67280 21.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362676 1362647 madalice 67216 27.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362700 1362629 madalice 65352 20.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1338336 1353308 cpanellogin 65136 0.0 S 36:20 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 63784 0.0 Sl 53-16:43:21 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1362686 1362628 madalice 61032 17.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362708 1362657 madalice 60664 16.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362698 1359858 madalice 60536 18.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362673 1362656 madalice 60388 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362711 1362644 madalice 60256 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362683 1359863 madalice 59156 15.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362722 1361315 madalice 59152 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362699 1362624 madalice 59048 15.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362710 1362643 madalice 57728 8.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362715 1362645 madalice 57168 8.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362712 1362652 madalice 55736 8.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362714 1362646 madalice 54788 8.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362716 1362649 madalice 50624 7.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362713 1362654 madalice 50316 7.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362674 1351114 madalice 43872 6.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1362734 1358425 madalice 42664 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42352 0.0 Ss 31-00:11:52 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 36240 0.1 Sl 53-16:43:17 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1362667 1353308 root 35384 0.0 S 00:02 whostmgrd - serving 185.247.137.253 2575382 1 root 34676 0.0 Ss 6-19:02:43 /usr/lib/systemd/systemd-journald 1342210 1 root 32336 0.0 Ss 30:52 lfd - sleeping 1463 1 root 26548 0.0 Ss 53-16:43:21 tailwatchd 1469 1 root 23616 0.1 Ss 53-16:43:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1356528 1276780 nobody 22488 0.0 S 09:52 /usr/sbin/httpd -k start 1356127 1276780 nobody 21932 0.0 S 10:31 /usr/sbin/httpd -k start 1359888 1276780 nobody 21908 0.0 S 04:06 /usr/sbin/httpd -k start 1360412 1276780 nobody 21440 0.0 S 03:14 /usr/sbin/httpd -k start 1358425 1276780 nobody 21436 0.0 S 06:12 /usr/sbin/httpd -k start 1359858 1276780 nobody 21436 0.0 S 04:09 /usr/sbin/httpd -k start 1351114 1276780 nobody 21156 0.0 S 17:54 /usr/sbin/httpd -k start 1359863 1276780 nobody 20908 0.0 S 04:08 /usr/sbin/httpd -k start 1359885 1276780 nobody 20664 0.0 S 04:06 /usr/sbin/httpd -k start 1361106 1276780 nobody 20628 0.0 S 02:20 /usr/sbin/httpd -k start 1359871 1276780 nobody 20384 0.0 S 04:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 1362758 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23014860 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 23014857 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 125 aaa/aaadownunder.com.au-ssl_log 95 madalice/madalice.com.au-ssl_log 39 evolution/portal.evolutionerp.com.au-ssl_log 17 olympic/olympicfencing.com.au 6 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 120 20.63.64.130 93 172.161.79.158 17 203.54.180.238 12 45.156.128.119 10 45.156.128.116 9 45.156.128.117 6 147.93.171.184 3 45.156.128.118 2 85.103.244.108 2 216.244.66.240 1 45.61.187.30 1 2a03:2880:f802:30:: 1 129.153.120.116 1 118.127.40.55 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 17 GET /heartbeat.php 4 GET / 3 GET /wp-login.php 2 GET /yup.php 2 GET /wp-temp.php 2 GET /wp-good.php 2 GET /wp-content/themes/index.php 2 GET /wp-content/index.php 2 GET /wp-content/cong.php 2 GET /wp-content/admin.php 2 GET /wp-admin/js/index.php 2 GET /term.php 2 GET /store/hand-painted-nike-cartoonsketchy/ 2 GET /gecko-new.php 2 GET /as.php 2 GET /a.php 2 GET /aa.php 2 GET /222.php 1 POST /wp-cron.php 1 POST /wp-admin/admin-ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /yup.php 2 GET /wp-temp.php 2 GET /wp-content/cong.php 1 POST /wp-admin/admin-ajax.php 1 GET /zxz.php 1 GET /zero.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /xyn.php 1 GET /xwpg.php 1 GET /x1da.php 1 GET /ws77.php -- last 10 requests -- 20.63.64.130 - - [22/Aug/2026:02:51:52 +1000] "GET /wmore1.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:53 +1000] "GET /special.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:53 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:53 +1000] "GET /thoms.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:54 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:54 +1000] "GET /root.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:55 +1000] "GET /fpwch.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:55 +1000] "GET /mg.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:56 +1000] "GET /reop3.php HTTP/1.1" 401 36 "-" "-" 20.63.64.130 - - [22/Aug/2026:02:51:56 +1000] "GET /php5.php HTTP/1.1" 401 36 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 GET /wp-login.php 1 POST /wp-cron.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php -- last 10 requests -- 172.161.79.158 - - [22/Aug/2026:02:51:37 +1000] "GET /fone1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:38 +1000] "GET /ncx.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:38 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:38 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:38 +1000] "GET /zup.php73 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:39 +1000] "GET /k.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:39 +1000] "GET /wp-blink.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:39 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:40 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [22/Aug/2026:02:51:40 +1000] "GET /wp-content/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET / 2 GET /store/hand-painted-nike-cartoonsketchy/ 1 GET /wp-login.php 1 GET /wp-json/wp/v2/tags/764 1 GET /wp-json 1 GET /wp-content/plugins/wpforms-lite/readme.txt 1 GET /wp-content/plugins/wordpress-seo/readme.txt 1 GET /wp-content/plugins/wordfence/readme.txt 1 GET /wp-content/plugins/woocommerce/readme.txt 1 GET /wp-content/plugins/updraftplus/readme.txt 1 GET /wp-content/plugins/seo-by-rank-math/readme.txt 1 GET /wp-content/plugins/redirection/readme.txt -- last 10 requests -- 45.156.128.118 - - [22/Aug/2026:02:53:05 +1000] "GET /wp-content/plugins/really-simple-ssl/readme.txt HTTP/1.1" 404 30634 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 45.156.128.117 - - [22/Aug/2026:02:53:05 +1000] "GET /wp-content/plugins/seo-by-rank-math/readme.txt HTTP/1.1" 404 30637 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 45.156.128.119 - - [22/Aug/2026:02:53:06 +1000] "GET /wp-content/plugins/all-in-one-seo-pack/readme.txt HTTP/1.1" 404 30642 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 45.156.128.119 - - [22/Aug/2026:02:53:07 +1000] "GET /wp-content/plugins/google-analytics-for-wordpress/readme.txt HTTP/1.1" 404 30638 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/5 45.156.128.116 - - [22/Aug/2026:02:53:08 +1000] "GET /wp-content/plugins/hostinger/readme.txt HTTP/1.1" 404 30662 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 45.156.128.116 - - [22/Aug/2026:02:53:07 +1000] "GET /wp-content/plugins/jetpack/readme.txt HTTP/1.1" 404 30635 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 45.156.128.116 - - [22/Aug/2026:02:53:08 +1000] "GET /wp-content/plugins/google-site-kit/readme.txt HTTP/1.1" 404 30663 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 45.156.128.117 - - [22/Aug/2026:02:53:08 +1000] "GET /wp-content/plugins/duplicate-page/readme.txt HTTP/1.1" 404 30662 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 45.156.128.117 - - [22/Aug/2026:02:53:08 +1000] "GET /wp-content/plugins/limit-login-attempts-reloaded/readme.txt HTTP/1.1" 404 30675 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/53 45.156.128.119 - - [22/Aug/2026:02:53:10 +1000] "GET /wp-content/plugins/litespeed-cache/readme.txt HTTP/1.1" 404 30662 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-22 02:50:54 L1=1.47 run=3 blk=0 avail=6402 (54.6%) swpO=0 conn=2 myRSS=2548 php=2 phpRSS=110 ap=18 tcp=28 topuser=root 2026-08-22 02:50:55 L1=1.47 run=3 blk=0 avail=6398 (54.6%) swpO=0 conn=1 myRSS=2548 php=1 phpRSS=71 ap=19 tcp=29 topuser=root 2026-08-22 02:51:04 L1=1.48 run=1 blk=0 avail=6386 (54.4%) swpO=0 conn=2 myRSS=2548 php=2 phpRSS=111 ap=19 tcp=31 topuser=root 2026-08-22 02:51:05 L1=1.48 run=4 blk=0 avail=6272 (53.5%) swpO=0 conn=1 myRSS=2548 php=2 phpRSS=230 ap=19 tcp=31 topuser=corpkicks 2026-08-22 02:51:14 L1=1.56 run=4 blk=0 avail=6381 (54.4%) swpO=0 conn=2 myRSS=2548 php=2 phpRSS=111 ap=20 tcp=31 topuser=root 2026-08-22 02:51:15 L1=1.56 run=3 blk=0 avail=6329 (54.0%) swpO=0 conn=1 myRSS=2548 php=2 phpRSS=159 ap=20 tcp=29 topuser=madalice 2026-08-22 02:51:24 L1=1.47 run=3 blk=0 avail=6259 (53.4%) swpO=0 conn=2 myRSS=2548 php=3 phpRSS=257 ap=20 tcp=31 topuser=alison 2026-08-22 02:51:25 L1=1.47 run=4 blk=0 avail=6243 (53.2%) swpO=0 conn=1 myRSS=2548 php=3 phpRSS=270 ap=20 tcp=31 topuser=madalice 2026-08-22 02:51:34 L1=1.56 run=3 blk=0 avail=6371 (54.3%) swpO=0 conn=2 myRSS=2548 php=2 phpRSS=111 ap=20 tcp=31 topuser=root 2026-08-22 02:51:35 L1=1.56 run=3 blk=0 avail=6258 (53.4%) swpO=0 conn=2 myRSS=2548 php=2 phpRSS=229 ap=20 tcp=31 topuser=madalice 2026-08-22 02:51:44 L1=1.55 run=3 blk=0 avail=6256 (53.3%) swpO=0 conn=2 myRSS=2548 php=3 phpRSS=264 ap=20 tcp=32 topuser=alison 2026-08-22 02:51:45 L1=1.55 run=2 blk=0 avail=6390 (54.5%) swpO=0 conn=2 myRSS=2548 php=1 phpRSS=71 ap=20 tcp=31 topuser=root 2026-08-22 02:51:54 L1=1.62 run=2 blk=0 avail=6376 (54.4%) swpO=0 conn=2 myRSS=2548 php=2 phpRSS=110 ap=20 tcp=32 topuser=root 2026-08-22 02:51:55 L1=1.62 run=4 blk=0 avail=6330 (54.0%) swpO=0 conn=2 myRSS=2548 php=2 phpRSS=162 ap=20 tcp=30 topuser=madalice 2026-08-22 02:52:04 L1=1.67 run=3 blk=0 avail=6276 (53.5%) swpO=1 conn=2 myRSS=2548 php=3 phpRSS=249 ap=20 tcp=30 topuser=madalice 2026-08-22 02:52:05 L1=1.67 run=2 blk=0 avail=6394 (54.5%) swpO=1 conn=2 myRSS=2549 php=1 phpRSS=71 ap=20 tcp=27 topuser=root 2026-08-22 02:52:14 L1=1.72 run=4 blk=0 avail=6324 (53.9%) swpO=3 conn=3 myRSS=2549 php=3 phpRSS=201 ap=20 tcp=28 topuser=tubesupplies 2026-08-22 02:52:15 L1=1.72 run=6 blk=0 avail=6228 (53.1%) swpO=3 conn=2 myRSS=2549 php=4 phpRSS=332 ap=20 tcp=29 topuser=madalice 2026-08-22 02:52:24 L1=1.61 run=2 blk=0 avail=6398 (54.5%) swpO=0 conn=3 myRSS=2549 php=2 phpRSS=110 ap=19 tcp=23 topuser=root 2026-08-22 02:52:26 L1=1.61 run=3 blk=0 avail=6340 (54.1%) swpO=0 conn=2 myRSS=2549 php=2 phpRSS=171 ap=18 tcp=24 topuser=madalice 2026-08-22 02:52:34 L1=1.68 run=4 blk=0 avail=6392 (54.5%) swpO=0 conn=3 myRSS=2549 php=3 phpRSS=154 ap=17 tcp=24 topuser=root 2026-08-22 02:52:36 L1=1.68 run=3 blk=0 avail=6274 (53.5%) swpO=0 conn=2 myRSS=2549 php=2 phpRSS=242 ap=17 tcp=24 topuser=madalice 2026-08-22 02:52:44 L1=1.73 run=2 blk=0 avail=6404 (54.6%) swpO=0 conn=3 myRSS=2549 php=2 phpRSS=110 ap=17 tcp=24 topuser=root 2026-08-22 02:52:46 L1=1.73 run=3 blk=0 avail=6282 (53.6%) swpO=0 conn=2 myRSS=2549 php=2 phpRSS=234 ap=17 tcp=24 topuser=madalice 2026-08-22 02:52:54 L1=1.77 run=3 blk=0 avail=6197 (52.8%) swpO=0 conn=3 myRSS=2549 php=2 phpRSS=309 ap=17 tcp=30 topuser=madalice 2026-08-22 02:52:56 L1=1.77 run=3 blk=0 avail=6411 (54.7%) swpO=0 conn=2 myRSS=2549 php=1 phpRSS=71 ap=17 tcp=28 topuser=root 2026-08-22 02:53:04 L1=1.72 run=5 blk=1 avail=6408 (54.6%) swpO=0 conn=3 myRSS=2549 php=1 phpRSS=71 ap=17 tcp=26 topuser=root 2026-08-22 02:53:06 L1=1.72 run=12 blk=0 avail=5999 (51.1%) swpO=0 conn=2 myRSS=2549 php=9 phpRSS=730 ap=17 tcp=72 topuser=madalice 2026-08-22 02:53:14 L1=3.35 run=23 blk=1 avail=5312 (45.3%) swpO=2551 conn=13 myRSS=2475 php=20 phpRSS=2066 ap=48 tcp=51 topuser=madalice 2026-08-22 02:53:16 L1=3.35 run=43 blk=0 avail=4580 (39.0%) swpO=2567 conn=36 myRSS=2471 php=38 phpRSS=3304 ap=47 tcp=41 topuser=madalice