INCIDENT 2026-08-22 22:58:20 trigger: mysql_conn=18 ================================================================== load: 12.75 4.80 2.08 5/663 2056571 ncpu:10 mem_avail: 6728MB/11729MB (57.4%) swap_used:3771MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 2 procs / 117MB heaviest user: madalice (2 procs, 117MB) apache: 55 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2350 nobody 54 941 root 240 646 netdata 8 255 madalice 2 128 mailman 20 92 cpanellogin 1 70 dovenull 6 26 lowrange 2 25 evolution 8 25 wp-toolkit 6 17 zabbix 1 14 mailnull 2 12 infinium 1 12 alison 1 12 named 1 11 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 2 131 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2995 MB Active(file): 1800 MB Inactive(file): 1086 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 425 MB CommitLimit: 9960 MB Committed_AS: 7526 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 21:47:04 2736 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2407176 10.2 Ssl 7-15:07:45 /usr/sbin/mariadbd 1220 1 netdata 202136 2.5 Ssl 54-12:48:27 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353014 1343371 root 159436 0.0 S 20:19:58 spamd child 1343371 1 root 72788 0.0 Ss 20:34:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1967987 1353308 cpanellogin 71716 0.0 S 02:35:55 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2056523 2055196 madalice 71124 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2056524 2055921 madalice 70484 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1846716 1343371 root 55596 0.0 S 06:16:39 spamd child 2575382 1 root 52060 0.0 Ss 7-15:07:48 /usr/lib/systemd/systemd-journald 2223 1201 root 50440 0.0 Sl 54-12:48:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 34724 0.1 Sl 54-12:48:22 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 32240 0.0 Ss 31-20:16:57 cpsrvd (SSL) - waiting for connections 1469 1 root 28356 0.1 Ss 54-12:48:26 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 21620 0.0 Rs 54-12:48:26 tailwatchd 2055172 1276780 nobody 21116 0.3 S 01:10 /usr/sbin/httpd -k start 2053582 1276780 nobody 20912 0.0 S 04:12 /usr/sbin/httpd -k start 2055171 1276780 nobody 20740 0.1 S 01:10 /usr/sbin/httpd -k start 2054155 1276780 nobody 20708 0.0 S 03:11 /usr/sbin/httpd -k start 2055238 1276780 nobody 20524 0.1 S 01:08 /usr/sbin/httpd -k start 1342210 1 root 20520 0.0 Ss 20:35:57 lfd - sleeping 2055236 1276780 nobody 20520 0.0 S 01:08 /usr/sbin/httpd -k start 2055222 1276780 nobody 20400 0.1 S 01:08 /usr/sbin/httpd -k start 2055247 1276780 nobody 20388 0.1 S 01:08 /usr/sbin/httpd -k start 2055226 1276780 nobody 20360 0.1 S 01:08 /usr/sbin/httpd -k start 2055128 1276780 nobody 20112 0.1 S 01:12 /usr/sbin/httpd -k start 2055921 1276780 nobody 20084 0.1 S 00:52 /usr/sbin/httpd -k start 2053595 1276780 nobody 20056 0.0 S 04:10 /usr/sbin/httpd -k start 2055246 1276780 nobody 19972 0.1 S 01:08 /usr/sbin/httpd -k start 2055251 1276780 nobody 19584 0.1 S 01:08 /usr/sbin/httpd -k start 2055204 1276780 nobody 19504 0.1 S 01:09 /usr/sbin/httpd -k start 2055240 1276780 nobody 19484 0.1 S 01:08 /usr/sbin/httpd -k start 2054168 1276780 nobody 19476 0.0 S 03:10 /usr/sbin/httpd -k start 2055227 1276780 nobody 19456 0.0 S 01:08 /usr/sbin/httpd -k start 2055245 1276780 nobody 19440 0.1 S 01:08 /usr/sbin/httpd -k start 2055235 1276780 nobody 19428 0.1 S 01:08 /usr/sbin/httpd -k start 2055196 1276780 nobody 19408 0.1 S 01:09 /usr/sbin/httpd -k start 2055231 1276780 nobody 19400 0.1 S 01:08 /usr/sbin/httpd -k start 2055218 1276780 nobody 19372 0.0 S 01:08 /usr/sbin/httpd -k start 2055241 1276780 nobody 19360 0.0 S 01:08 /usr/sbin/httpd -k start 2055219 1276780 nobody 19340 0.1 S 01:08 /usr/sbin/httpd -k start 2055916 1276780 nobody 19328 0.0 S 00:52 /usr/sbin/httpd -k start 2055239 1276780 nobody 19308 0.0 S 01:08 /usr/sbin/httpd -k start 2055194 1276780 nobody 19304 0.0 S 01:09 /usr/sbin/httpd -k start 2055162 1276780 nobody 19280 0.0 S 01:11 /usr/sbin/httpd -k start 2055220 1276780 nobody 19276 0.1 S 01:08 /usr/sbin/httpd -k start 2055248 1276780 nobody 19272 0.0 S 01:08 /usr/sbin/httpd -k start 2055199 1276780 nobody 19260 0.0 S 01:09 /usr/sbin/httpd -k start 2055173 1276780 nobody 19236 0.0 S 01:10 /usr/sbin/httpd -k start 2055203 1276780 nobody 19236 0.0 S 01:09 /usr/sbin/httpd -k start 2055191 1276780 nobody 19208 0.1 S 01:09 /usr/sbin/httpd -k start 2055229 1276780 nobody 19136 0.0 S 01:08 /usr/sbin/httpd -k start 2055917 1276780 nobody 19096 0.0 R 00:52 /usr/sbin/httpd -k start 2055189 1276780 nobody 19080 0.0 S 01:09 /usr/sbin/httpd -k start 2055910 1276780 nobody 18936 0.0 S 00:54 /usr/sbin/httpd -k start 2055176 1276780 nobody 18336 0.0 S 01:10 /usr/sbin/httpd -k start 2056331 1276780 nobody 18068 0.6 S 00:19 /usr/sbin/httpd -k start 185104 2431 netdata 17688 2.1 Sl 10-02:24:45 /usr/libexec/netdata/plugins.d/apps.plugin 1 2056404 1276780 nobody 17664 0.1 S 00:13 /usr/sbin/httpd -k start 2055920 1276780 nobody 15980 0.2 S 00:52 /usr/sbin/httpd -k start 2049371 1276780 nobody 15728 0.0 S 12:25 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23198755 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 290 lowrange/lowrange.com.au-ssl_log 99 speedlin/speedlinefencing.com.au-ssl_log 38 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 270 34.6.163.81 99 20.52.41.200 37 34.139.206.249 15 118.127.40.55 1 2a03:2880:f802:1f:: 1 114.119.146.16 1 114.119.143.104 1 114.119.137.101 1 114.119.131.88 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 27 GET /fetch 14 POST / 8 GET /proxy 5 GET /store/hand-painted-nike-bandana/ 5 GET / 3 GET /read 3 GET /.gitlab-ci.yml 3 GET /.git/HEAD 3 GET /.git-credentials 3 GET /.git/config 3 GET /@fs/proc/self/environ 3 GET /download 2 POST /graphql 2 GET /z9x8c7v6b5-debug-trigger-www.speedlinefencing.com.au 2 GET /wp-login.php 2 GET /webhook 2 GET /user/login 2 GET /signin 2 GET /screenshot 2 GET /redirect --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 27 GET /fetch 14 POST / 8 GET /proxy 5 GET /store/hand-painted-nike-bandana/ 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /webhook 2 GET /screenshot 2 GET /redirect 2 GET /preview 2 GET /image -- last 10 requests -- 34.6.163.81 - - [22/Aug/2026:22:58:15 +1000] "GET /proxy?url=file%3A%2F%2F%2Froot%2F.env HTTP/1.1" 404 30642 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:58:18 +1000] "GET /secrets.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.6.163.81 - - [22/Aug/2026:22:58:18 +1000] "GET /app_dev.php/_profiler/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.6.163.81 - - [22/Aug/2026:22:58:18 +1000] "GET /.hermes/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:58:18 +1000] "GET /.openclaw/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:58:18 +1000] "GET /management/env HTTP/1.1" 404 30621 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.6.163.81 - - [22/Aug/2026:22:58:20 +1000] "GET /.aws/metadata/iam/security-credentials/ HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:58:20 +1000] "GET /config/.env.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:58:20 +1000] "GET /.env.test HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.6.163.81 - - [22/Aug/2026:22:58:20 +1000] "GET /_profiler/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/SimplePie/wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/fonts/ -- last 10 requests -- 20.52.41.200 - - [22/Aug/2026:22:58:16 +1000] "GET /gecko-new.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:16 +1000] "GET /NewFile.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:16 +1000] "GET /wp-Blogs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:17 +1000] "GET /wp-includes/fonts/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:17 +1000] "GET /themes.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:17 +1000] "GET /cv.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:18 +1000] "GET /wp-admin/js/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:18 +1000] "GET /wp-content/uploads/index.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:18 +1000] "GET /ws83.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:18 +1000] "GET /atex1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /z9x8c7v6b5-debug-trigger-www.speedlinefencing.com.au 2 GET /user/login 2 GET /signin 2 GET /login 2 GET /.gitlab-ci.yml 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig 2 GET /.git/config 2 GET /auth/login 2 GET /admin/login 2 GET / -- last 10 requests -- 34.139.206.249 - - [22/Aug/2026:22:57:12 +1000] "GET /manage HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:13 +1000] "GET /portal HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:14 +1000] "GET /my HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:12 +1000] "POST /graphql HTTP/1.1" 404 9092 "https://www.speedlinefencing.com.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 S 34.139.206.249 - - [22/Aug/2026:22:57:14 +1000] "GET /account HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:13 +1000] "GET /app HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:13 +1000] "GET /auth/login HTTP/1.1" 404 9085 "https://www.speedlinefencing.com.au/auth/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrom 34.139.206.249 - - [22/Aug/2026:22:57:14 +1000] "GET /admin/login HTTP/1.1" 404 9084 "https://www.speedlinefencing.com.au/admin/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr 34.139.206.249 - - [22/Aug/2026:22:57:15 +1000] "GET /profile HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" 34.139.206.249 - - [22/Aug/2026:22:57:13 +1000] "GET /wp-login.php HTTP/1.1" 200 2024 "https://speedlinefencing.com.au/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0 --- last 30 samples (run-up to this incident) --- 2026-08-22 22:55:54 L1=1.25 run=1 blk=0 avail=6990 (59.6%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=14 tcp=30 topuser=- 2026-08-22 22:55:58 L1=1.15 run=1 blk=0 avail=6988 (59.6%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=14 tcp=30 topuser=- 2026-08-22 22:56:04 L1=1.05 run=1 blk=0 avail=6985 (59.6%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=14 tcp=29 topuser=- 2026-08-22 22:56:08 L1=0.97 run=1 blk=0 avail=6998 (59.7%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=26 topuser=- 2026-08-22 22:56:14 L1=0.89 run=1 blk=0 avail=7000 (59.7%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=26 topuser=- 2026-08-22 22:56:18 L1=0.82 run=1 blk=0 avail=7000 (59.7%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=25 topuser=- 2026-08-22 22:56:24 L1=0.75 run=2 blk=0 avail=6873 (58.6%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=158 ap=13 tcp=27 topuser=madalice 2026-08-22 22:56:28 L1=0.69 run=1 blk=0 avail=7015 (59.8%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=27 topuser=- 2026-08-22 22:56:34 L1=0.64 run=1 blk=0 avail=7014 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=26 topuser=- 2026-08-22 22:56:39 L1=0.59 run=1 blk=0 avail=7013 (59.8%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=25 topuser=- 2026-08-22 22:56:44 L1=0.54 run=2 blk=0 avail=7014 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:56:49 L1=0.58 run=3 blk=0 avail=6891 (58.8%) swpO=0 conn=1 myRSS=2436 php=1 phpRSS=156 ap=13 tcp=23 topuser=madalice 2026-08-22 22:56:55 L1=0.61 run=1 blk=0 avail=7017 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:56:59 L1=0.56 run=1 blk=0 avail=7012 (59.8%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:57:05 L1=0.60 run=1 blk=0 avail=7015 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=21 topuser=- 2026-08-22 22:57:09 L1=0.63 run=3 blk=0 avail=6903 (58.9%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=113 ap=16 tcp=70 topuser=speedlin 2026-08-22 22:57:15 L1=2.10 run=29 blk=0 avail=5017 (42.8%) swpO=301 conn=21 myRSS=2428 php=22 phpRSS=2261 ap=76 tcp=78 topuser=madalice 2026-08-22 22:57:19 L1=4.82 run=41 blk=0 avail=4014 (34.2%) swpO=3111 conn=27 myRSS=2356 php=30 phpRSS=3305 ap=71 tcp=75 topuser=madalice 2026-08-22 22:57:29 L1=7.37 run=11 blk=0 avail=5491 (46.8%) swpO=2007 conn=7 myRSS=2357 php=7 phpRSS=1369 ap=79 tcp=84 topuser=madalice 2026-08-22 22:57:29 L1=7.37 run=10 blk=0 avail=5547 (47.3%) swpO=0 conn=27 myRSS=2357 php=7 phpRSS=1178 ap=79 tcp=84 topuser=madalice 2026-08-22 22:57:39 L1=9.26 run=31 blk=0 avail=4040 (34.4%) swpO=0 conn=26 myRSS=2357 php=24 phpRSS=3389 ap=72 tcp=51 topuser=madalice 2026-08-22 22:57:39 L1=9.26 run=43 blk=0 avail=4035 (34.4%) swpO=0 conn=25 myRSS=2357 php=24 phpRSS=3358 ap=72 tcp=51 topuser=madalice 2026-08-22 22:57:50 L1=10.71 run=14 blk=1 avail=5194 (44.3%) swpO=509 conn=10 myRSS=2350 php=9 phpRSS=1691 ap=62 tcp=43 topuser=madalice 2026-08-22 22:57:50 L1=10.71 run=14 blk=0 avail=5337 (45.5%) swpO=509 conn=10 myRSS=2350 php=9 phpRSS=1709 ap=62 tcp=42 topuser=madalice 2026-08-22 22:58:00 L1=12.18 run=22 blk=0 avail=5496 (46.9%) swpO=0 conn=16 myRSS=2350 php=16 phpRSS=1808 ap=55 tcp=67 topuser=madalice 2026-08-22 22:58:00 L1=12.18 run=21 blk=1 avail=5516 (47.0%) swpO=0 conn=16 myRSS=2350 php=16 phpRSS=1792 ap=55 tcp=67 topuser=madalice 2026-08-22 22:58:10 L1=14.00 run=25 blk=0 avail=4181 (35.6%) swpO=0 conn=18 myRSS=2350 php=17 phpRSS=3168 ap=54 tcp=56 topuser=madalice 2026-08-22 22:58:10 L1=14.00 run=21 blk=0 avail=4193 (35.8%) swpO=0 conn=17 myRSS=2350 php=17 phpRSS=3158 ap=54 tcp=56 topuser=madalice 2026-08-22 22:58:20 L1=12.75 run=4 blk=0 avail=6728 (57.4%) swpO=0 conn=18 myRSS=2350 php=2 phpRSS=117 ap=55 tcp=56 topuser=madalice 2026-08-22 22:58:21 L1=12.75 run=4 blk=0 avail=6733 (57.4%) swpO=0 conn=17 myRSS=2350 php=2 phpRSS=119 ap=55 tcp=56 topuser=madalice