INCIDENT 2026-08-24 21:51:42 trigger: php_rss=1983MB mysql_conn=16 ================================================================== load: 1.64 0.97 1.06 18/639 1258741 ncpu:10 mem_avail: 4793MB/11729MB (40.9%) swap_used:3610MB swapout:0/s blocked(D):0 running:17 iowait:0.0% steal:0.0% php: 15 procs / 1983MB heaviest user: madalice (15 procs, 1983MB) apache: 31 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3082 madalice 15 2178 root 234 747 nobody 30 523 netdata 8 264 mailman 20 92 cpanellogin 1 65 dovenull 6 26 mailnull 4 24 wp-toolkit 6 18 zabbix 1 14 evolution 4 13 infinium 1 12 kurri 1 11 named 1 10 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 15 2210 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4751 MB Active(file): 3248 MB Inactive(file): 673 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 383 MB CommitLimit: 9960 MB Committed_AS: 9113 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3032611 root 20:40:26 2416 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3156408 10.0 Ssl 9-14:01:09 /usr/sbin/mariadbd 1258678 1242038 madalice 264488 58.5 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258690 1225935 madalice 229304 66.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 212144 2.5 Ssl 56-11:41:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1258679 1243059 madalice 208544 47.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3080744 3075441 root 175764 0.0 S 19:19:06 spamd child 1258697 1242906 madalice 157740 63.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3879330 3075441 root 145196 0.0 S 07:52:53 spamd child 1258703 1258683 madalice 105280 69.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258704 1258685 madalice 104812 72.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258705 1258686 madalice 94332 55.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3075441 1 root 89944 0.0 Ss 19:28:45 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1258707 1258684 madalice 82656 44.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258706 1258681 madalice 82396 43.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258709 1258682 madalice 78084 36.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258710 1258688 madalice 77196 34.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1258708 1258687 madalice 74848 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3418681 1353308 cpanellogin 67008 0.0 S 11:52:51 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 54104 0.0 Sl 56-11:41:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 40668 0.1 Ss 56-11:41:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2575382 1 root 37360 0.0 Ss 9-14:01:12 /usr/lib/systemd/systemd-journald 4922 2431 netdata 33680 0.1 Sl 56-11:41:46 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1258673 1258669 madalice 28012 59.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1242906 1276780 nobody 24480 0.0 S 04:11 /usr/sbin/httpd -k start 1243087 1276780 nobody 23372 0.0 S 03:58 /usr/sbin/httpd -k start 1463 1 root 23156 0.0 Ss 56-11:41:50 tailwatchd 1243086 1276780 nobody 22920 0.0 S 03:58 /usr/sbin/httpd -k start 1225935 1276780 nobody 22824 0.0 S 10:14 /usr/sbin/httpd -k start 1242136 1276780 nobody 22736 0.0 S 05:07 /usr/sbin/httpd -k start 1227600 1276780 nobody 22576 0.0 S 07:16 /usr/sbin/httpd -k start 1243059 1276780 nobody 22432 0.0 S 03:59 /usr/sbin/httpd -k start 1242038 1276780 nobody 22224 0.0 S 05:13 /usr/sbin/httpd -k start 1353308 1 root 21844 0.0 Ss 33-19:10:21 cpsrvd (SSL) - waiting for connections 1241774 1276780 nobody 21712 0.0 S 05:48 /usr/sbin/httpd -k start 3074682 1 root 21172 0.0 Ss 19:29:19 lfd - sleeping 1242143 1276780 nobody 20696 0.0 S 05:06 /usr/sbin/httpd -k start 1227616 1276780 nobody 20580 0.0 S 07:15 /usr/sbin/httpd -k start 1243732 1276780 nobody 19340 0.0 S 03:02 /usr/sbin/httpd -k start 1258670 1276780 nobody 18724 0.0 S 00:04 /usr/sbin/httpd -k start 1258669 1276780 nobody 18128 0.0 S 00:04 /usr/sbin/httpd -k start 185104 2431 netdata 18116 2.1 Sl 12-01:18:09 /usr/libexec/netdata/plugins.d/apps.plugin 1 1258647 1276780 nobody 18116 0.0 S 00:05 /usr/sbin/httpd -k start 1258620 1276780 nobody 18080 0.1 S 00:09 /usr/sbin/httpd -k start 1258648 1276780 nobody 18080 0.2 S 00:05 /usr/sbin/httpd -k start 1258668 1276780 nobody 18080 0.2 S 00:04 /usr/sbin/httpd -k start 1258667 1276780 nobody 17700 0.0 S 00:04 /usr/sbin/httpd -k start 1471 1 root 17076 0.0 Ss 56-11:41:50 cPhulkd - processor 704625 1471 root 16868 0.0 S 02:51:05 cPhulkd - dbprocessor 1258632 1276780 nobody 16220 0.0 S 00:06 /usr/sbin/httpd -k start 1258683 1276780 nobody 15668 0.3 S 00:03 /usr/sbin/httpd -k start 1258686 1276780 nobody 15668 0.0 S 00:03 /usr/sbin/httpd -k start 1258681 1276780 nobody 15640 0.0 S 00:03 /usr/sbin/httpd -k start 1258688 1276780 nobody 15640 0.0 S 00:03 /usr/sbin/httpd -k start 1258682 1276780 nobody 15620 0.0 S 00:03 /usr/sbin/httpd -k start 1258685 1276780 nobody 15620 0.0 S 00:03 /usr/sbin/httpd -k start 1258687 1276780 nobody 15620 0.0 S 00:03 /usr/sbin/httpd -k start 1258684 1276780 nobody 15560 0.0 S 00:03 /usr/sbin/httpd -k start 1204 1 zabbix 15180 0.2 Ssl 56-11:41:51 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1258750 1276780 nobody 14596 0.0 S 00:00 /usr/sbin/httpd -k start 1258631 1471 root 13672 0.0 S 00:06 cPhulkd - processor - http socket --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 28077089 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 97 evolution/portal.evolutionerp.com.au-ssl_log 61 madalice/madalice.com.au-ssl_log 15 tubesupplies/tubesupplies.com.au-ssl_log 13 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 97 4.232.148.111 59 203.54.180.238 26 1.209.110.147 2 91.92.243.249 2 91.92.243.243 2 52.167.144.24 2 118.127.40.55 1 54.85.126.86 1 54.84.147.79 1 52.204.174.139 1 44.208.223.68 1 34.236.222.216 1 23.21.179.120 1 2001:4860:7:501::fa 1 18.214.186.220 --- top request paths across all vhosts (last 3 min) --- 29 GET /factory_session_checker.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 15 GET / 4 POST /wp-login.php 4 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 3 GET /wp-json/wp/v2/users 2 POST /wp-cron.php 2 GET /wp-json/oembed/1.0/embed 2 GET /wp-content/plugins/elementor/assets/lib/ 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp/wp-login.php 1 GET /wp-trackback.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php 1 GET /wp-signin.php -- last 10 requests -- 4.232.148.111 - - [24/Aug/2026:21:51:05 +1000] "GET /install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:05 +1000] "GET /radio.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:05 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:06 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:06 +1000] "GET /Ov-Simple1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:06 +1000] "GET /fm.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:06 +1000] "GET /ftde.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:07 +1000] "GET /hplfuns.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:07 +1000] "GET /log.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [24/Aug/2026:21:51:07 +1000] "GET /test.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 29 GET /factory_session_checker.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 1 GET /userlogin.php 1 GET /index.php -- last 10 requests -- 52.167.144.24 - - [24/Aug/2026:21:51:08 +1000] "GET /index.php HTTP/1.1" 302 2944 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Sa 52.167.144.24 - - [24/Aug/2026:21:51:09 +1000] "GET /userlogin.php HTTP/1.1" 200 1969 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.7 203.54.180.238 - - [24/Aug/2026:21:51:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:21:51:11 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 132 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [24/Aug/2026:21:51:11 +1000] "GET /factory_session_joiner.php?id=34808 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [24/Aug/2026:21:51:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:21:51:20 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:21:51:21 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 132 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [24/Aug/2026:21:51:21 +1000] "GET /factory_session_joiner.php?id=34808 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [24/Aug/2026:21:51:25 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == madalice/madalice.com.au-ssl_log == -- top paths -- 14 GET / 4 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 3 GET /wp-json/wp/v2/users 2 GET /wp-json/oembed/1.0/embed 1 GET /wp/wp-login.php 1 GET /wp-sitemap.xml 1 GET /wp-sitemap-users-1.xml 1 GET /wp-login.php 1 GET /store/toys-kids-custom-shoes/ 1 GET /sitemap_index.xml 1 GET /robots.txt 1 GET /product-tag/personalised-socks/ -- last 10 requests -- 1.209.110.147 - - [24/Aug/2026:21:51:37 +1000] "GET /?author=12 HTTP/1.1" 404 29620 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 1.209.110.147 - - [24/Aug/2026:21:51:37 +1000] "GET /?author=2 HTTP/1.1" 404 29621 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 1.209.110.147 - - [24/Aug/2026:21:51:38 +1000] "GET /wp-json/oembed/1.0/embed?url=https%3A%2F%2Fmadalice.com.au%2F HTTP/1.1" 200 1315 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 1.209.110.147 - - [24/Aug/2026:21:51:38 +1000] "GET /?author=4 HTTP/1.1" 404 29621 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 1.209.110.147 - - [24/Aug/2026:21:51:38 +1000] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 401 94 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 1.209.110.147 - - [24/Aug/2026:21:51:37 +1000] "GET /?author=6 HTTP/1.1" 404 29621 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 1.209.110.147 - - [24/Aug/2026:21:51:39 +1000] "GET /?author=3 HTTP/1.1" 404 29622 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 1.209.110.147 - - [24/Aug/2026:21:51:39 +1000] "GET /author-sitemap.xml HTTP/1.1" 404 29797 "https://madalice.com.au/wp-sitemap-users-1.xml" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck 1.209.110.147 - - [24/Aug/2026:21:51:38 +1000] "GET /?author=1 HTTP/1.1" 404 29623 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 1.209.110.147 - - [24/Aug/2026:21:51:39 +1000] "GET /?author=21 HTTP/1.1" 404 29621 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-24 21:49:16 L1=0.51 run=3 blk=0 avail=6258 (53.4%) swpO=0 conn=1 myRSS=3082 php=1 phpRSS=161 ap=15 tcp=22 topuser=madalice 2026-08-24 21:49:21 L1=0.63 run=1 blk=0 avail=6385 (54.4%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-24 21:49:27 L1=0.58 run=2 blk=0 avail=6300 (53.7%) swpO=0 conn=1 myRSS=3082 php=1 phpRSS=121 ap=15 tcp=22 topuser=alison 2026-08-24 21:49:31 L1=0.53 run=1 blk=0 avail=6391 (54.5%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-24 21:49:37 L1=0.57 run=1 blk=0 avail=6393 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-24 21:49:41 L1=0.52 run=1 blk=0 avail=6395 (54.5%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=16 topuser=- 2026-08-24 21:49:47 L1=0.48 run=1 blk=0 avail=6395 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-24 21:49:51 L1=0.44 run=1 blk=0 avail=6396 (54.5%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-24 21:49:57 L1=0.41 run=1 blk=0 avail=6395 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-24 21:50:01 L1=0.45 run=3 blk=0 avail=6356 (54.2%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-24 21:50:07 L1=0.50 run=3 blk=0 avail=6153 (52.5%) swpO=0 conn=1 myRSS=3082 php=1 phpRSS=263 ap=15 tcp=21 topuser=madalice 2026-08-24 21:50:11 L1=0.54 run=2 blk=0 avail=6228 (53.1%) swpO=0 conn=3 myRSS=3082 php=2 phpRSS=219 ap=15 tcp=23 topuser=tubesupplies 2026-08-24 21:50:17 L1=0.50 run=1 blk=0 avail=6389 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-24 21:50:21 L1=0.54 run=1 blk=0 avail=6387 (54.5%) swpO=0 conn=3 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-24 21:50:27 L1=0.65 run=1 blk=0 avail=6389 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-24 21:50:31 L1=0.60 run=2 blk=0 avail=6389 (54.5%) swpO=0 conn=3 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-24 21:50:37 L1=0.63 run=1 blk=0 avail=6387 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-24 21:50:42 L1=0.58 run=2 blk=0 avail=6370 (54.3%) swpO=0 conn=3 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-24 21:50:47 L1=0.54 run=1 blk=0 avail=6384 (54.4%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-24 21:50:52 L1=0.57 run=1 blk=0 avail=6387 (54.5%) swpO=0 conn=3 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-24 21:50:57 L1=0.53 run=1 blk=0 avail=6394 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-24 21:51:02 L1=0.48 run=1 blk=0 avail=6390 (54.5%) swpO=0 conn=3 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-24 21:51:07 L1=0.45 run=4 blk=0 avail=6143 (52.4%) swpO=0 conn=1 myRSS=3082 php=2 phpRSS=304 ap=15 tcp=22 topuser=corpkicks 2026-08-24 21:51:12 L1=0.49 run=2 blk=0 avail=6173 (52.6%) swpO=0 conn=2 myRSS=3082 php=1 phpRSS=246 ap=16 tcp=20 topuser=corpkicks 2026-08-24 21:51:17 L1=0.45 run=1 blk=0 avail=6382 (54.4%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-24 21:51:22 L1=0.41 run=1 blk=0 avail=6385 (54.4%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=16 tcp=17 topuser=- 2026-08-24 21:51:27 L1=0.38 run=2 blk=0 avail=6284 (53.6%) swpO=0 conn=1 myRSS=3082 php=1 phpRSS=140 ap=15 tcp=20 topuser=madalice 2026-08-24 21:51:32 L1=0.35 run=6 blk=0 avail=5709 (48.7%) swpO=0 conn=2 myRSS=3082 php=5 phpRSS=841 ap=15 tcp=25 topuser=madalice 2026-08-24 21:51:37 L1=0.48 run=14 blk=0 avail=5357 (45.7%) swpO=0 conn=10 myRSS=3082 php=9 phpRSS=1321 ap=19 tcp=48 topuser=madalice 2026-08-24 21:51:42 L1=1.64 run=17 blk=0 avail=4793 (40.9%) swpO=0 conn=16 myRSS=3082 php=15 phpRSS=1983 ap=31 tcp=49 topuser=madalice