INCIDENT 2026-08-22 22:57:15 trigger: php_rss=2261MB mysql_conn=21 ================================================================== load: 2.10 1.23 0.81 29/702 2055293 ncpu:10 mem_avail: 5017MB/11729MB (42.8%) swap_used:3640MB swapout:301/s blocked(D):0 running:29 iowait:0.1% steal:0.0% php: 22 procs / 2261MB heaviest user: madalice (10 procs, 1353MB) apache: 76 procs tcp_estab: 78 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2428 madalice 10 1429 nobody 75 891 speedlin 10 831 root 241 680 netdata 8 258 mailman 20 92 cpanellogin 1 71 dovenull 6 26 lowrange 2 25 evolution 8 25 wp-toolkit 6 20 zabbix 1 16 named 1 12 infinium 1 12 alison 1 12 candyfabcom 1 11 kurri 1 10 nscd 1 7 dovecot 3 7 --- php workers by user --- USER PROCS RSS_MB madalice 10 1444 speedlin 12 868 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5811 MB Active(file): 2590 MB Inactive(file): 2009 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 463 MB CommitLimit: 9960 MB Committed_AS: 10745 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 21:45:59 2316 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2485912 10.2 Ssl 7-15:06:40 /usr/sbin/mariadbd 2055206 2055191 madalice 219616 54.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 204720 2.5 Ssl 54-12:47:22 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2055217 2055204 madalice 187448 57.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055211 2055195 madalice 184620 46.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055213 2055196 madalice 169548 51.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055216 2055201 madalice 169248 51.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353014 1343371 root 166444 0.0 S 20:18:53 spamd child 2055214 2055198 madalice 153136 43.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055215 2055200 madalice 138176 43.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055207 2055194 madalice 136888 30.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055210 2053423 speedlin 136824 27.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055254 2053595 speedlin 123336 49.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055257 2054144 madalice 115396 49.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055253 2055161 speedlin 110328 41.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055262 2053582 speedlin 98636 67.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055255 2055177 speedlin 90104 30.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055258 2055172 speedlin 89464 31.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055259 2055126 speedlin 87060 28.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055256 2049371 speedlin 84020 30.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055260 2048182 madalice 82564 44.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1343371 1 root 75652 0.0 Ss 20:33:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1967987 1353308 cpanellogin 73508 0.0 S 02:34:50 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1846716 1343371 root 69860 0.0 S 06:15:34 spamd child 2055261 2055173 speedlin 66928 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055264 2055128 speedlin 60400 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 52144 0.0 Sl 54-12:47:21 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2575382 1 root 51704 0.0 Ss 7-15:06:43 /usr/lib/systemd/systemd-journald 2055299 2055189 speedlin 47624 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055312 2055171 speedlin 47616 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2055298 2054155 speedlin 46964 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 37824 0.0 Ss 31-20:15:52 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35284 0.1 Sl 54-12:47:17 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 29436 0.1 Ss 54-12:47:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2048182 1276780 nobody 22544 0.0 S 13:05 /usr/sbin/httpd -k start 2049371 1276780 nobody 22236 0.0 S 11:20 /usr/sbin/httpd -k start 2049363 1276780 nobody 22040 0.0 S 11:21 /usr/sbin/httpd -k start 1463 1 root 21788 0.0 Ss 54-12:47:21 tailwatchd 1342210 1 root 21304 0.0 Ss 20:34:52 lfd - sleeping 2054144 1276780 nobody 20392 0.0 S 02:07 /usr/sbin/httpd -k start 2053423 1276780 nobody 19656 0.0 S 03:18 /usr/sbin/httpd -k start 2051123 1276780 nobody 19596 0.0 S 07:45 /usr/sbin/httpd -k start 2055129 1276780 nobody 19520 0.1 S 00:07 /usr/sbin/httpd -k start 2055128 1276780 nobody 19136 0.8 S 00:07 /usr/sbin/httpd -k start 2053595 1276780 nobody 18664 0.0 S 03:05 /usr/sbin/httpd -k start 2054155 1276780 nobody 18600 0.0 S 02:06 /usr/sbin/httpd -k start 185104 2431 netdata 17716 2.1 Sl 10-02:23:40 /usr/libexec/netdata/plugins.d/apps.plugin 1 2055163 1276780 nobody 17508 0.1 S 00:06 /usr/sbin/httpd -k start 2055189 1276780 nobody 17420 0.2 S 00:04 /usr/sbin/httpd -k start 2055171 1276780 nobody 17392 0.2 S 00:05 /usr/sbin/httpd -k start 2053582 1276780 nobody 17268 0.0 S 03:07 /usr/sbin/httpd -k start 1204 1 zabbix 17040 0.2 Ssl 54-12:47:22 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2054168 1276780 nobody 16588 0.0 S 02:05 /usr/sbin/httpd -k start 2055126 1276780 nobody 16380 0.1 S 00:08 /usr/sbin/httpd -k start 2055177 1276780 nobody 16276 0.0 S 00:05 /usr/sbin/httpd -k start 2055196 1276780 nobody 15940 0.2 S 00:04 /usr/sbin/httpd -k start 2055161 1276780 nobody 15932 0.0 S 00:06 /usr/sbin/httpd -k start 2055172 1276780 nobody 15908 0.0 S 00:05 /usr/sbin/httpd -k start 2055204 1276780 nobody 15880 0.0 S 00:04 /usr/sbin/httpd -k start 2055194 1276780 nobody 15812 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23198555 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 120 speedlin/speedlinefencing.com.au-ssl_log 30 madalice/madalice.com.au-ssl_log 16 evolution/my.evolutionerp.com.au-ssl_log 9 evolution/release.evolutionerp.com.au 9 tubesupplies/tubesupplies.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 2 alison/alisonarts.com.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 2 otterfencing/otterfencing.com.au 2 corpkicks/2025.corporatekicks.com.au-ssl_log 1 evolution/release.evolutionerp.com.au-ssl_log 1 otterfencing/otterfencing.com.au-ssl_log 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 120 20.203.141.11 28 34.139.206.249 18 20.151.9.151 11 43.228.157.166 8 118.127.40.55 2 91.92.243.243 2 85.208.98.55 2 161.153.32.84 1 91.92.243.245 1 54.156.55.147 1 40.77.167.49 1 34.196.51.17 1 209.141.33.142 1 114.119.159.70 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 5 POST /wp-cron.php 4 POST /wp-login.php 3 POST / 3 GET / 2 GET /z9x8c7v6b5-debug-trigger-www.speedlinefencing.com.au 2 GET /wp-content/themes/seotheme/db.php 2 GET /user/login 2 GET /taff.php 2 GET /signin 2 GET /qyffk.php 2 GET /oxse.php 2 GET /login 2 GET /.gitlab-ci.yml 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig 2 GET /.git/config 2 GET /encryption.php 2 GET /connection-test.php 2 GET /checkinfo.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/SimplePie/wp-login.php -- last 10 requests -- 20.203.141.11 - - [22/Aug/2026:22:55:44 +1000] "GET /wp-blink.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:44 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:45 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:45 +1000] "GET /wp-content/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:45 +1000] "GET /ww5.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:46 +1000] "GET /2.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:46 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:46 +1000] "GET /atomlib.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:47 +1000] "GET /rip.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [22/Aug/2026:22:55:47 +1000] "GET /p.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /z9x8c7v6b5-debug-trigger-www.speedlinefencing.com.au 2 GET /user/login 2 GET /signin 2 GET /login 2 GET /.gitlab-ci.yml 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig 2 GET /.git/config 2 GET / 1 POST /wp-cron.php 1 GET /our-work/ -- last 10 requests -- 34.139.206.249 - - [22/Aug/2026:22:57:11 +1000] "GET /.gitlab-ci.yml HTTP/1.1" 404 45250 "https://www.speedlinefencing.com.au/.gitlab-ci.yml" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/ 34.139.206.249 - - [22/Aug/2026:22:57:11 +1000] "GET /user/login HTTP/1.1" 404 9085 "https://www.speedlinefencing.com.au/user/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrom 34.139.206.249 - - [22/Aug/2026:22:57:11 +1000] "GET /login HTTP/1.1" 302 1 "https://www.speedlinefencing.com.au/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 S 34.139.206.249 - - [22/Aug/2026:22:57:12 +1000] "GET /admin/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:11 +1000] "GET /.gitconfig HTTP/1.1" 404 45250 "https://www.speedlinefencing.com.au/.gitconfig" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +ht 34.139.206.249 - - [22/Aug/2026:22:57:11 +1000] "GET /admin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:12 +1000] "GET /console HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:13 +1000] "GET /signin HTTP/1.1" 404 9085 "https://www.speedlinefencing.com.au/signin" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0. 34.139.206.249 - - [22/Aug/2026:22:57:12 +1000] "GET /dashboard HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:12 +1000] "GET /manage HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/hand-painted-nike-bandana/ 3 POST / 2 GET /wp-content/themes/seotheme/db.php 1 POST /wp-plain.php 1 POST /ALFA_DATA/alfacgiapi/perl.alfa 1 POST /alfacgiapi/perl.alfa 1 GET /wp-content/plugins/fix/up.php 1 GET /wp-content/plugins/apikey/apikey.php.suspected 1 GET /wp-content/plugins/apikey/apikey.php 1 GET /vohccnor.php 1 GET /store/hand-painted-nike-cartoonsketchy/ 1 GET /static../etc/passwd -- last 10 requests -- 34.6.163.81 - - [22/Aug/2026:22:57:12 +1000] "GET /app/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:57:12 +1000] "GET /static../.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.6.163.81 - - [22/Aug/2026:22:57:13 +1000] "GET /@fs/root/.aws/credentials?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:57:14 +1000] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:57:17 +1000] "GET /@fs/../.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.6.163.81 - - [22/Aug/2026:22:57:12 +1000] "GET /.git/HEAD HTTP/1.1" 404 30623 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 34.6.163.81 - - [22/Aug/2026:22:57:16 +1000] "GET /?file=../../../../etc/passwd HTTP/1.1" 403 6222 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.6.163.81 - - [22/Aug/2026:22:57:17 +1000] "GET /download?file=../../../../etc/passwd HTTP/1.1" 403 6222 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:57:12 +1000] "GET /api/config HTTP/1.1" 404 30624 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.6.163.81 - - [22/Aug/2026:22:57:12 +1000] "GET /static../etc/passwd HTTP/1.1" 404 30627 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" --- last 30 samples (run-up to this incident) --- 2026-08-22 22:54:48 L1=2.07 run=2 blk=0 avail=6944 (59.2%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=60 ap=16 tcp=32 topuser=aaa 2026-08-22 22:54:54 L1=1.90 run=2 blk=0 avail=6976 (59.5%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=16 tcp=28 topuser=- 2026-08-22 22:54:58 L1=1.75 run=1 blk=0 avail=6978 (59.5%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=16 tcp=26 topuser=- 2026-08-22 22:55:04 L1=1.85 run=1 blk=0 avail=6995 (59.6%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=15 tcp=26 topuser=- 2026-08-22 22:55:08 L1=1.70 run=2 blk=0 avail=6915 (59.0%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=111 ap=15 tcp=35 topuser=madalice 2026-08-22 22:55:14 L1=1.97 run=1 blk=0 avail=6933 (59.1%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=22 tcp=35 topuser=- 2026-08-22 22:55:18 L1=1.81 run=1 blk=0 avail=6945 (59.2%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=21 tcp=27 topuser=- 2026-08-22 22:55:24 L1=1.66 run=1 blk=0 avail=6978 (59.5%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=16 tcp=24 topuser=- 2026-08-22 22:55:28 L1=1.61 run=1 blk=0 avail=6982 (59.5%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=15 tcp=28 topuser=- 2026-08-22 22:55:34 L1=1.48 run=4 blk=0 avail=6798 (58.0%) swpO=0 conn=1 myRSS=2436 php=3 phpRSS=273 ap=15 tcp=33 topuser=tubesupplies 2026-08-22 22:55:38 L1=1.60 run=2 blk=0 avail=6845 (58.4%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=161 ap=15 tcp=31 topuser=otterfencing 2026-08-22 22:55:44 L1=1.47 run=1 blk=0 avail=6978 (59.5%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=15 tcp=29 topuser=- 2026-08-22 22:55:48 L1=1.36 run=2 blk=0 avail=6869 (58.6%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=137 ap=15 tcp=31 topuser=alison 2026-08-22 22:55:54 L1=1.25 run=1 blk=0 avail=6990 (59.6%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=14 tcp=30 topuser=- 2026-08-22 22:55:58 L1=1.15 run=1 blk=0 avail=6988 (59.6%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=14 tcp=30 topuser=- 2026-08-22 22:56:04 L1=1.05 run=1 blk=0 avail=6985 (59.6%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=14 tcp=29 topuser=- 2026-08-22 22:56:08 L1=0.97 run=1 blk=0 avail=6998 (59.7%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=26 topuser=- 2026-08-22 22:56:14 L1=0.89 run=1 blk=0 avail=7000 (59.7%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=26 topuser=- 2026-08-22 22:56:18 L1=0.82 run=1 blk=0 avail=7000 (59.7%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=25 topuser=- 2026-08-22 22:56:24 L1=0.75 run=2 blk=0 avail=6873 (58.6%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=158 ap=13 tcp=27 topuser=madalice 2026-08-22 22:56:28 L1=0.69 run=1 blk=0 avail=7015 (59.8%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=27 topuser=- 2026-08-22 22:56:34 L1=0.64 run=1 blk=0 avail=7014 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=26 topuser=- 2026-08-22 22:56:39 L1=0.59 run=1 blk=0 avail=7013 (59.8%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=25 topuser=- 2026-08-22 22:56:44 L1=0.54 run=2 blk=0 avail=7014 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:56:49 L1=0.58 run=3 blk=0 avail=6891 (58.8%) swpO=0 conn=1 myRSS=2436 php=1 phpRSS=156 ap=13 tcp=23 topuser=madalice 2026-08-22 22:56:55 L1=0.61 run=1 blk=0 avail=7017 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:56:59 L1=0.56 run=1 blk=0 avail=7012 (59.8%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:57:05 L1=0.60 run=1 blk=0 avail=7015 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=21 topuser=- 2026-08-22 22:57:09 L1=0.63 run=3 blk=0 avail=6903 (58.9%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=113 ap=16 tcp=70 topuser=speedlin 2026-08-22 22:57:15 L1=2.10 run=29 blk=0 avail=5017 (42.8%) swpO=301 conn=21 myRSS=2428 php=22 phpRSS=2261 ap=76 tcp=78 topuser=madalice