INCIDENT 2026-08-22 22:59:24 trigger: mysql_conn=21 ================================================================== load: 8.52 5.48 2.53 3/623 2057605 ncpu:10 mem_avail: 7104MB/11729MB (60.6%) swap_used:3824MB swapout:1/s blocked(D):0 running:5 iowait:1.8% steal:0.0% php: 2 procs / 93MB heaviest user: infinium (1 procs, 71MB) apache: 17 procs tcp_estab: 21 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2319 root 239 622 nobody 16 259 netdata 8 254 mailman 20 92 infinium 2 88 cpanellogin 1 69 evolution 9 62 dovenull 6 26 lowrange 2 25 wp-toolkit 6 17 zabbix 1 15 mailnull 2 12 alison 1 12 named 1 11 corpkicks 1 11 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB infinium 1 78 evolution 1 40 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2660 MB Active(file): 1612 MB Inactive(file): 993 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 418 MB CommitLimit: 9960 MB Committed_AS: 6497 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 21:48:08 2728 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2375576 10.2 Ssl 7-15:08:49 /usr/sbin/mariadbd 1220 1 netdata 201984 2.5 Ssl 54-12:49:31 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353014 1343371 root 151208 0.0 S 20:21:02 spamd child 2057578 2055128 infinium 90748 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1343371 1 root 72332 0.0 Ss 20:36:01 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1967987 1353308 cpanellogin 71324 0.0 S 02:36:59 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2057591 2057245 evolution 64088 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1846716 1343371 root 55156 0.0 S 06:17:43 spamd child 2575382 1 root 52364 0.0 Ss 7-15:08:52 /usr/lib/systemd/systemd-journald 2223 1201 root 50440 0.0 Sl 54-12:49:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33816 0.1 Sl 54-12:49:26 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 29812 0.0 Ss 31-20:18:01 cpsrvd (SSL) - waiting for connections 1469 1 root 27824 0.1 Ss 54-12:49:30 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 21576 0.0 Ss 54-12:49:30 tailwatchd 2055247 1276780 nobody 20700 0.0 S 02:12 /usr/sbin/httpd -k start 2055229 1276780 nobody 20636 0.0 S 02:12 /usr/sbin/httpd -k start 2055921 1276780 nobody 20484 0.0 S 01:56 /usr/sbin/httpd -k start 1342210 1 root 20444 0.0 Ss 20:37:01 lfd - sleeping 2055245 1276780 nobody 20420 0.0 S 02:12 /usr/sbin/httpd -k start 2055246 1276780 nobody 20272 0.1 S 02:12 /usr/sbin/httpd -k start 2056514 1276780 nobody 19612 0.0 S 01:07 /usr/sbin/httpd -k start 2056500 1276780 nobody 19492 0.0 S 01:10 /usr/sbin/httpd -k start 2055248 1276780 nobody 19348 0.0 S 02:12 /usr/sbin/httpd -k start 2056513 1276780 nobody 19108 0.0 S 01:07 /usr/sbin/httpd -k start 185104 2431 netdata 17756 2.1 Sl 10-02:25:49 /usr/libexec/netdata/plugins.d/apps.plugin 1 2057245 1276780 nobody 17668 0.0 S 00:49 /usr/sbin/httpd -k start 2055128 1276780 nobody 16788 0.1 S 02:16 /usr/sbin/httpd -k start 1204 1 zabbix 16312 0.2 Ssl 54-12:49:31 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2049371 1276780 nobody 15904 0.0 S 13:29 /usr/sbin/httpd -k start 2055172 1276780 nobody 15600 0.2 S 02:14 /usr/sbin/httpd -k start 2049363 1276780 nobody 15096 0.0 S 13:30 /usr/sbin/httpd -k start 1591218 1471 root 13488 0.0 S 13:57:20 cPhulkd - dbprocessor 1471 1 root 13184 0.0 Ss 54-12:49:30 cPhulkd - processor 2014757 3828812 lowrange 13112 0.0 S 01:15:41 dovecot/imap 2019213 3828812 alison 13076 0.0 S 01:08:22 dovecot/imap 2029117 3828812 lowrange 12648 0.0 S 49:54 dovecot/imap 2045151 3828812 infinium 12560 0.0 S 21:39 dovecot/imap 2057445 3828812 corpkicks 12104 0.0 S 00:23 dovecot/imap 2107664 1 named 11796 0.0 Ssl 3-20:36:45 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1276780 1 root 11236 0.0 Ss 17-07:28:06 /usr/sbin/httpd -k start 2057246 3828812 root 11108 0.0 S 00:48 dovecot/auth -w 3668761 3828812 kurri 10808 0.0 S 2-12:45:10 dovecot/imap 2107879 1 root 9360 0.0 Ss 3-20:36:44 queueprocd - waiting up to 60s to process a task 1059098 3828812 dovenull 8040 0.0 S 9-07:26:36 dovecot/imap-login 2057576 2111716 mailnull 7660 0.0 S 00:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1059102 3828812 dovenull 7552 0.0 S 9-07:26:36 dovecot/imap-login 1466 1 root 7532 0.0 Ss 54-12:49:30 dnsadmin - dormant mode 2111078 1 nscd 7496 0.0 Ssl 3-20:36:34 /usr/sbin/nscd 918817 27524 root 7408 0.0 Ss 1-07:45:27 sshd: evolution [priv] 4028163 27524 root 6380 0.0 Ss 2-07:39:48 sshd: evolution [priv] 1 0 root 6196 0.2 Ss 54-12:49:39 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 4028165 27524 root 5876 0.0 Ss 2-07:39:48 sshd: root [priv] 1059104 3828812 dovenull 5864 0.0 S 9-07:26:36 dovecot/pop3-login 4161699 27524 root 5804 0.0 Ss 2-05:11:44 sshd: evolution [priv] 1667290 2431 netdata 5752 0.0 Sl 11:45:52 /usr/libexec/netdata/plugins.d/debugfs.plugin 1 1059100 3828812 dovenull 5728 0.0 S 9-07:26:36 dovecot/pop3-login 906072 1 evolution 5424 0.0 Ss 4-23:02:51 /usr/lib/systemd/systemd --user 2111825 2111790 mailman 5288 0.0 S 3-20:36:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 2111818 2111790 mailman 5116 0.0 S 3-20:36:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 2111816 2111790 mailman 5112 0.0 S 3-20:36:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23198858 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 343 lowrange/lowrange.com.au-ssl_log 119 coscom/coscom.com.au-ssl_log 100 speedlin/speedlinefencing.com.au-ssl_log 38 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 312 34.6.163.81 119 20.52.41.200 100 74.248.24.12 37 34.139.206.249 26 118.127.40.55 2 114.119.146.16 1 2a03:2880:f802:1f:: 1 114.119.159.70 1 114.119.143.104 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 27 GET /fetch 25 POST / 8 GET /proxy 6 GET / 5 GET /store/hand-painted-nike-bandana/ 3 GET /wp-login.php 3 GET /read 3 GET /.gitlab-ci.yml 3 GET /.git/HEAD 3 GET /.git-credentials 3 GET /.git/config 3 GET /@fs/proc/self/environ 3 GET /download 2 POST /graphql 2 GET /z9x8c7v6b5-debug-trigger-www.speedlinefencing.com.au 2 GET /x.php 2 GET /xleet.php 2 GET /xda.php 2 GET /ws83.php 2 GET /ws54.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 27 GET /fetch 25 POST / 8 GET /proxy 5 GET /store/hand-painted-nike-bandana/ 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /webhook 2 GET /screenshot 2 GET /redirect 2 GET /preview 2 GET /pms -- last 10 requests -- 34.6.163.81 - - [22/Aug/2026:22:58:36 +1000] "GET /..%252F..%252F..%252F..%252F..%252Froot/.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@a 118.127.40.55 - - [22/Aug/2026:22:58:30 +1000] "POST /?wordfence_syncAttackData=1787403510.2418 HTTP/1.1" 200 36651 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [22/Aug/2026:22:58:30 +1000] "POST /?wordfence_syncAttackData=1787403510.2565 HTTP/1.1" 200 36653 "-" "WordPress/7.1; https://madalice.com.au" 34.6.163.81 - - [22/Aug/2026:22:58:38 +1000] "GET /%2eaws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.6.163.81 - - [22/Aug/2026:22:58:35 +1000] "GET /k8s/eks/credentials HTTP/1.1" 404 30626 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.6.163.81 - - [22/Aug/2026:22:58:35 +1000] "GET /api/v1/credentials HTTP/1.1" 404 30625 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.6.163.81 - - [22/Aug/2026:22:58:35 +1000] "GET /.gcloud/credentials HTTP/1.1" 404 30625 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.6.163.81 - - [22/Aug/2026:22:58:37 +1000] "GET /credentials HTTP/1.1" 404 30623 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.6.163.81 - - [22/Aug/2026:22:58:38 +1000] "GET /admin/config?cmd=cat+/root/.aws/credentials HTTP/1.1" 404 30644 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.c 114.119.159.70 - - [22/Aug/2026:22:58:51 +1000] "GET /store/hand-painted-nike-bandana/?amp%3Bwcpr_rating=1&verified=1&rating=5 HTTP/1.1" 200 48984 "https://madalice.com.au/store/hand-painted-nike-bandana/?amp%3Bwcpr_rati == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/SimplePie/wp-login.php -- last 10 requests -- 20.52.41.200 - - [22/Aug/2026:22:58:22 +1000] "GET /k.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:23 +1000] "GET /wp-blink.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:23 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:23 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:24 +1000] "GET /wp-content/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:24 +1000] "GET /ww5.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:24 +1000] "GET /2.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:25 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:25 +1000] "GET /atomlib.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [22/Aug/2026:22:58:25 +1000] "GET /rip.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/SimplePie/wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/fonts/ -- last 10 requests -- 74.248.24.12 - - [22/Aug/2026:22:59:09 +1000] "GET /NewFile.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:09 +1000] "GET /wp-Blogs.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:09 +1000] "GET /wp-includes/fonts/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:10 +1000] "GET /themes.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:10 +1000] "GET /cv.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:10 +1000] "GET /wp-admin/js/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:10 +1000] "GET /wp-content/uploads/index.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:11 +1000] "GET /ws83.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:11 +1000] "GET /atex1.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [22/Aug/2026:22:59:11 +1000] "GET /class-t.api.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-22 22:56:55 L1=0.61 run=1 blk=0 avail=7017 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:56:59 L1=0.56 run=1 blk=0 avail=7012 (59.8%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=24 topuser=- 2026-08-22 22:57:05 L1=0.60 run=1 blk=0 avail=7015 (59.8%) swpO=0 conn=2 myRSS=2436 php=0 phpRSS=0 ap=13 tcp=21 topuser=- 2026-08-22 22:57:09 L1=0.63 run=3 blk=0 avail=6903 (58.9%) swpO=0 conn=2 myRSS=2436 php=1 phpRSS=113 ap=16 tcp=70 topuser=speedlin 2026-08-22 22:57:15 L1=2.10 run=29 blk=0 avail=5017 (42.8%) swpO=301 conn=21 myRSS=2428 php=22 phpRSS=2261 ap=76 tcp=78 topuser=madalice 2026-08-22 22:57:19 L1=4.82 run=41 blk=0 avail=4014 (34.2%) swpO=3111 conn=27 myRSS=2356 php=30 phpRSS=3305 ap=71 tcp=75 topuser=madalice 2026-08-22 22:57:29 L1=7.37 run=11 blk=0 avail=5491 (46.8%) swpO=2007 conn=7 myRSS=2357 php=7 phpRSS=1369 ap=79 tcp=84 topuser=madalice 2026-08-22 22:57:29 L1=7.37 run=10 blk=0 avail=5547 (47.3%) swpO=0 conn=27 myRSS=2357 php=7 phpRSS=1178 ap=79 tcp=84 topuser=madalice 2026-08-22 22:57:39 L1=9.26 run=31 blk=0 avail=4040 (34.4%) swpO=0 conn=26 myRSS=2357 php=24 phpRSS=3389 ap=72 tcp=51 topuser=madalice 2026-08-22 22:57:39 L1=9.26 run=43 blk=0 avail=4035 (34.4%) swpO=0 conn=25 myRSS=2357 php=24 phpRSS=3358 ap=72 tcp=51 topuser=madalice 2026-08-22 22:57:50 L1=10.71 run=14 blk=1 avail=5194 (44.3%) swpO=509 conn=10 myRSS=2350 php=9 phpRSS=1691 ap=62 tcp=43 topuser=madalice 2026-08-22 22:57:50 L1=10.71 run=14 blk=0 avail=5337 (45.5%) swpO=509 conn=10 myRSS=2350 php=9 phpRSS=1709 ap=62 tcp=42 topuser=madalice 2026-08-22 22:58:00 L1=12.18 run=22 blk=0 avail=5496 (46.9%) swpO=0 conn=16 myRSS=2350 php=16 phpRSS=1808 ap=55 tcp=67 topuser=madalice 2026-08-22 22:58:00 L1=12.18 run=21 blk=1 avail=5516 (47.0%) swpO=0 conn=16 myRSS=2350 php=16 phpRSS=1792 ap=55 tcp=67 topuser=madalice 2026-08-22 22:58:10 L1=14.00 run=25 blk=0 avail=4181 (35.6%) swpO=0 conn=18 myRSS=2350 php=17 phpRSS=3168 ap=54 tcp=56 topuser=madalice 2026-08-22 22:58:10 L1=14.00 run=21 blk=0 avail=4193 (35.8%) swpO=0 conn=17 myRSS=2350 php=17 phpRSS=3158 ap=54 tcp=56 topuser=madalice 2026-08-22 22:58:20 L1=12.75 run=4 blk=0 avail=6728 (57.4%) swpO=0 conn=18 myRSS=2350 php=2 phpRSS=117 ap=55 tcp=56 topuser=madalice 2026-08-22 22:58:21 L1=12.75 run=4 blk=0 avail=6733 (57.4%) swpO=0 conn=17 myRSS=2350 php=2 phpRSS=119 ap=55 tcp=56 topuser=madalice 2026-08-22 22:58:31 L1=14.53 run=30 blk=0 avail=3452 (29.4%) swpO=0 conn=31 myRSS=2350 php=30 phpRSS=4288 ap=49 tcp=62 topuser=madalice 2026-08-22 22:58:33 L1=16.49 run=25 blk=1 avail=3232 (27.6%) swpO=2578 conn=21 myRSS=2319 php=22 phpRSS=4188 ap=48 tcp=51 topuser=madalice 2026-08-22 22:58:41 L1=16.61 run=7 blk=0 avail=6003 (51.2%) swpO=3352 conn=6 myRSS=2319 php=5 phpRSS=1051 ap=52 tcp=38 topuser=madalice 2026-08-22 22:58:44 L1=15.28 run=1 blk=0 avail=6905 (58.9%) swpO=0 conn=21 myRSS=2319 php=0 phpRSS=0 ap=50 tcp=33 topuser=- 2026-08-22 22:58:51 L1=14.06 run=1 blk=1 avail=6959 (59.3%) swpO=0 conn=6 myRSS=2319 php=0 phpRSS=0 ap=42 tcp=18 topuser=- 2026-08-22 22:58:54 L1=13.09 run=2 blk=1 avail=6740 (57.5%) swpO=0 conn=21 myRSS=2319 php=1 phpRSS=262 ap=39 tcp=23 topuser=madalice 2026-08-22 22:59:01 L1=12.04 run=1 blk=0 avail=7014 (59.8%) swpO=0 conn=6 myRSS=2319 php=0 phpRSS=0 ap=32 tcp=19 topuser=- 2026-08-22 22:59:04 L1=11.08 run=2 blk=0 avail=7038 (60.0%) swpO=0 conn=21 myRSS=2319 php=0 phpRSS=0 ap=29 tcp=26 topuser=- 2026-08-22 22:59:11 L1=10.19 run=2 blk=0 avail=6891 (58.8%) swpO=0 conn=2 myRSS=2319 php=1 phpRSS=234 ap=22 tcp=22 topuser=corpkicks 2026-08-22 22:59:14 L1=9.53 run=6 blk=1 avail=6981 (59.5%) swpO=0 conn=21 myRSS=2319 php=3 phpRSS=214 ap=19 tcp=23 topuser=infinium 2026-08-22 22:59:21 L1=9.09 run=2 blk=0 avail=7077 (60.3%) swpO=0 conn=2 myRSS=2319 php=1 phpRSS=90 ap=18 tcp=22 topuser=evolution 2026-08-22 22:59:24 L1=8.52 run=5 blk=0 avail=7104 (60.6%) swpO=1 conn=21 myRSS=2319 php=2 phpRSS=93 ap=17 tcp=21 topuser=infinium