INCIDENT 2026-08-24 21:57:06 trigger: swapout=2092/s ================================================================== load: 2.66 1.43 1.19 13/645 1274949 ncpu:10 mem_avail: 4938MB/11729MB (42.1%) swap_used:3691MB swapout:2092/s blocked(D):0 running:23 iowait:0.6% steal:0.0% php: 13 procs / 1322MB heaviest user: madalice (12 procs, 1279MB) apache: 37 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3023 madalice 10 1132 root 236 735 nobody 36 610 netdata 8 261 mailman 20 92 cpanellogin 1 64 alison 1 54 dovenull 6 26 mailnull 3 23 kurri 2 21 wp-toolkit 6 18 zabbix 1 14 evolution 4 13 aaa 1 13 infinium 1 12 corpkicks 1 11 named 1 10 dovecot 3 7 nscd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 10 1149 alison 1 55 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3615 MB Active(file): 2140 MB Inactive(file): 935 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 380 MB CommitLimit: 9960 MB Committed_AS: 8720 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3032611 root 20:45:50 2212 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3096192 10.0 Ssl 9-14:06:33 /usr/sbin/mariadbd 1274905 1274810 madalice 219796 64.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 209424 2.5 Ssl 56-11:47:15 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1274907 1274779 madalice 191948 93.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1274906 1258669 madalice 190756 54.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3080744 3075441 root 175372 0.0 S 19:24:30 spamd child 1274908 1274893 madalice 153840 63.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1274909 1274856 madalice 141428 57.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3879330 3075441 root 136768 0.0 S 07:58:17 spamd child 1274912 1273921 madalice 107052 80.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1274919 1274898 madalice 94700 55.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1274916 1273837 madalice 93372 54.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3075441 1 root 89936 0.0 Ss 19:34:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1274917 1274897 madalice 86620 50.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1274918 1274896 madalice 79252 37.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3418681 1353308 cpanellogin 66112 0.0 S 11:58:15 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1274921 1274900 alison 64940 20.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 51324 0.0 Sl 56-11:47:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1274969 1274895 corpkicks 42216 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1469 1 root 40172 0.1 Ss 56-11:47:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2575382 1 root 38308 0.0 Ss 9-14:06:36 /usr/lib/systemd/systemd-journald 4922 2431 netdata 32948 0.1 Sl 56-11:47:10 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1243059 1276780 nobody 25900 0.0 S 09:23 /usr/sbin/httpd -k start 1463 1 root 23124 0.0 Ss 56-11:47:14 tailwatchd 1258669 1276780 nobody 22316 0.0 S 05:28 /usr/sbin/httpd -k start 1353308 1 root 21812 0.0 Ss 33-19:15:45 cpsrvd (SSL) - waiting for connections 3074682 1 root 21024 0.0 Ss 19:34:43 lfd - sleeping 1273870 1276780 nobody 20912 0.0 S 01:43 /usr/sbin/httpd -k start 1258895 1276780 nobody 20868 0.0 S 05:23 /usr/sbin/httpd -k start 1273923 1276780 nobody 20820 0.0 S 01:39 /usr/sbin/httpd -k start 1258632 1276780 nobody 20568 0.0 S 05:30 /usr/sbin/httpd -k start 1273954 1276780 nobody 20344 0.0 S 01:38 /usr/sbin/httpd -k start 1273837 1276780 nobody 19740 0.0 S 01:47 /usr/sbin/httpd -k start 1273914 1276780 nobody 19480 0.0 S 01:40 /usr/sbin/httpd -k start 1273921 1276780 nobody 19276 0.0 S 01:39 /usr/sbin/httpd -k start 1274856 1276780 nobody 18880 0.1 S 00:06 /usr/sbin/httpd -k start 1273955 1276780 nobody 18848 0.1 S 01:38 /usr/sbin/httpd -k start 1274779 1276780 nobody 18408 0.1 S 00:13 /usr/sbin/httpd -k start 1274783 1276780 nobody 18332 0.1 S 00:11 /usr/sbin/httpd -k start 1274809 1276780 nobody 18272 0.2 S 00:10 /usr/sbin/httpd -k start 1274888 1276780 nobody 18148 0.4 S 00:05 /usr/sbin/httpd -k start 1274855 1276780 nobody 18144 0.1 S 00:06 /usr/sbin/httpd -k start 1274886 1276780 nobody 18144 0.2 S 00:05 /usr/sbin/httpd -k start 1274887 1276780 nobody 18144 0.4 S 00:05 /usr/sbin/httpd -k start 1274778 1276780 nobody 18108 0.0 S 00:13 /usr/sbin/httpd -k start 185104 2431 netdata 18092 2.1 Sl 12-01:23:33 /usr/libexec/netdata/plugins.d/apps.plugin 1 1274851 1276780 nobody 18084 0.1 S 00:07 /usr/sbin/httpd -k start 1274885 1276780 nobody 18052 0.4 S 00:05 /usr/sbin/httpd -k start 1274810 1276780 nobody 17780 0.0 S 00:10 /usr/sbin/httpd -k start 1274776 1276780 nobody 16912 0.0 S 00:14 /usr/sbin/httpd -k start 1274203 1276780 nobody 16892 0.0 S 01:21 /usr/sbin/httpd -k start 1471 1 root 16604 0.0 Ss 56-11:47:14 cPhulkd - processor 704625 1471 root 16476 0.0 S 02:56:29 cPhulkd - dbprocessor 1274895 1276780 nobody 16444 0.2 S 00:04 /usr/sbin/httpd -k start 1274893 1276780 nobody 15732 0.0 S 00:04 /usr/sbin/httpd -k start 1274898 1276780 nobody 15732 0.0 S 00:04 /usr/sbin/httpd -k start 1274896 1276780 nobody 15640 0.2 S 00:04 /usr/sbin/httpd -k start 1274897 1276780 nobody 15620 0.0 S 00:04 /usr/sbin/httpd -k start 1274900 1276780 nobody 15540 0.0 S 00:04 /usr/sbin/httpd -k start 1274899 1276780 nobody 15452 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 1220 Dsl - /usr/sbin/netdata -P /run/netdata/netdata.pid -D --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 28077566 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au-ssl_log 89 madalice/madalice.com.au-ssl_log 74 olympic/seb-mobile-auth.olympicfencing.com.au 45 evolution/portal.evolutionerp.com.au-ssl_log 43 customc/customcentral.com.au-ssl_log 9 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 89 20.52.41.200 45 20.104.50.220 43 203.54.180.238 42 46.249.100.193 28 2001:41d0:404:200::9300 7 220.118.193.178 2 114.119.140.234 1 43.164.129.191 1 118.127.40.55 1 114.119.159.70 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 45 GET / 21 GET /factory_session_checker.php 11 GET /factory_session_processed_qty.php 11 GET /factory_session_joiner.php 6 GET /wp-json/wp/v2/users 4 GET /wp/wp-login.php 4 GET /wp-login.php 4 GET /wp-json/oembed/1.0/embed 4 GET /blog/wp-login.php 3 GET /feed/ 2 GET /xx.php 2 GET /wp-sitemap.xml 2 GET /wp-sitemap-users-1.xml 2 GET /sitemap_index.xml 2 GET /feed/rss/ 1 POST /wp-cron.php 1 GET /zoom1.php 1 GET /zolando.php 1 GET /ykewuql.php 1 GET /ykdyxlo.php --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php 1 GET /wp-includes/PHPMailer/ -- last 10 requests -- 20.52.41.200 - - [24/Aug/2026:21:56:41 +1000] "GET /xx.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:41 +1000] "GET /wp-content/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:42 +1000] "GET /wp-includes/assets/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:42 +1000] "GET /wp-the.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:42 +1000] "GET /ws81.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:43 +1000] "GET /3.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:43 +1000] "GET /a1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:43 +1000] "GET /ca5.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:43 +1000] "GET /install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:21:56:44 +1000] "GET /radio.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 36 GET / 6 GET /wp-json/wp/v2/users 4 GET /wp/wp-login.php 4 GET /wp-login.php 4 GET /wp-json/oembed/1.0/embed 4 GET /blog/wp-login.php 3 GET /feed/ 2 GET /wp-sitemap.xml 2 GET /wp-sitemap-users-1.xml 2 GET /sitemap_index.xml 2 GET /feed/rss/ 1 GET /store/hand-painted-nike-af1-pink-pastel-flower/ -- last 10 requests -- 2001:41d0:404:200::9300 - - [24/Aug/2026:21:56:59 +1000] "GET /?author=3 HTTP/1.1" 404 29632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 2001:41d0:404:200::9300 - - [24/Aug/2026:21:57:00 +1000] "GET /?author=15 HTTP/1.1" 404 29632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 2001:41d0:404:200::9300 - - [24/Aug/2026:21:56:59 +1000] "GET /wp-sitemap-users-1.xml HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 2001:41d0:404:200::9300 - - [24/Aug/2026:21:56:59 +1000] "GET /?author=6 HTTP/1.1" 404 29632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 2001:41d0:404:200::9300 - - [24/Aug/2026:21:57:00 +1000] "GET /?author=4 HTTP/1.1" 404 29632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 2001:41d0:404:200::9300 - - [24/Aug/2026:21:57:01 +1000] "GET /wp-json/oembed/1.0/embed?url=https%3A%2F%2Fmadalice.com.au HTTP/1.1" 200 1313 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 2001:41d0:404:200::9300 - - [24/Aug/2026:21:57:01 +1000] "GET /?author=8 HTTP/1.1" 404 29632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 2001:41d0:404:200::9300 - - [24/Aug/2026:21:57:01 +1000] "GET /feed/ HTTP/1.1" 500 172 "https://madalice.com.au/feed/rss/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0. 2001:41d0:404:200::9300 - - [24/Aug/2026:21:57:03 +1000] "GET /?author=10 HTTP/1.1" 404 29632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 2001:41d0:404:200::9300 - - [24/Aug/2026:21:57:02 +1000] "GET /sitemap_index.xml HTTP/1.1" 200 441 "https://madalice.com.au/wp-sitemap.xml" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko == olympic/seb-mobile-auth.olympicfencing.com.au == -- top paths -- 1 GET /zolando.php 1 GET /ykewuql.php 1 GET /ykdyxlo.php 1 GET /yee.php 1 GET /xx.php 1 GET /xwpg.php 1 GET /xty.php 1 GET /wp-mjfb.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wpconf.php 1 GET /wp-bxroot.php 1 GET /wp-admin/css/sOTYbUf.php -- last 10 requests -- 20.104.50.220 - - [24/Aug/2026:21:57:02 +1000] "GET /file2.php HTTP/1.1" 301 303 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:02 +1000] "GET /hi.php HTTP/1.1" 301 300 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:03 +1000] "GET /nhd.php HTTP/1.1" 301 301 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:03 +1000] "GET /sol.php HTTP/1.1" 301 301 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:04 +1000] "GET /hah.php HTTP/1.1" 301 301 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:04 +1000] "GET /msg.php HTTP/1.1" 301 301 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:04 +1000] "GET /yee.php HTTP/1.1" 301 301 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:05 +1000] "GET /ssk.php HTTP/1.1" 301 301 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:05 +1000] "GET /koj.php HTTP/1.1" 301 301 "-" "-" 20.104.50.220 - - [24/Aug/2026:21:57:06 +1000] "GET /202d9.php HTTP/1.1" 301 303 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-24 21:54:38 L1=0.47 run=1 blk=0 avail=6387 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-24 21:54:45 L1=0.39 run=2 blk=0 avail=6363 (54.2%) swpO=0 conn=2 myRSS=3082 php=1 phpRSS=58 ap=14 tcp=17 topuser=madalice 2026-08-24 21:54:48 L1=0.39 run=1 blk=0 avail=6390 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-24 21:54:55 L1=0.33 run=1 blk=0 avail=6388 (54.5%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-24 21:54:58 L1=0.33 run=1 blk=0 avail=6387 (54.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=14 tcp=17 topuser=- 2026-08-24 21:55:05 L1=0.36 run=2 blk=0 avail=6382 (54.4%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-24 21:55:08 L1=0.36 run=3 blk=0 avail=6351 (54.2%) swpO=0 conn=1 myRSS=3082 php=1 phpRSS=64 ap=14 tcp=17 topuser=corpkicks 2026-08-24 21:55:15 L1=0.69 run=4 blk=0 avail=6053 (51.6%) swpO=0 conn=4 myRSS=3082 php=3 phpRSS=419 ap=14 tcp=25 topuser=madalice 2026-08-24 21:55:18 L1=0.69 run=5 blk=0 avail=5773 (49.2%) swpO=0 conn=1 myRSS=3082 php=4 phpRSS=714 ap=16 tcp=28 topuser=madalice 2026-08-24 21:55:25 L1=2.32 run=13 blk=0 avail=5250 (44.8%) swpO=0 conn=4 myRSS=3082 php=11 phpRSS=1401 ap=28 tcp=55 topuser=madalice 2026-08-24 21:55:28 L1=2.32 run=9 blk=0 avail=5551 (47.3%) swpO=0 conn=1 myRSS=3082 php=7 phpRSS=897 ap=35 tcp=55 topuser=madalice 2026-08-24 21:55:35 L1=2.86 run=2 blk=0 avail=6051 (51.6%) swpO=0 conn=4 myRSS=3082 php=2 phpRSS=211 ap=38 tcp=26 topuser=tubesupplies 2026-08-24 21:55:38 L1=2.86 run=1 blk=0 avail=6227 (53.1%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=35 tcp=22 topuser=- 2026-08-24 21:55:45 L1=2.42 run=9 blk=0 avail=5896 (50.3%) swpO=0 conn=4 myRSS=3082 php=6 phpRSS=552 ap=30 tcp=42 topuser=customc 2026-08-24 21:55:48 L1=2.42 run=4 blk=0 avail=6144 (52.4%) swpO=0 conn=1 myRSS=3082 php=2 phpRSS=143 ap=36 tcp=42 topuser=madalice 2026-08-24 21:55:55 L1=2.19 run=1 blk=0 avail=6251 (53.3%) swpO=0 conn=4 myRSS=3082 php=0 phpRSS=0 ap=33 tcp=20 topuser=- 2026-08-24 21:55:58 L1=2.19 run=1 blk=0 avail=6273 (53.5%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=30 tcp=19 topuser=- 2026-08-24 21:56:05 L1=1.86 run=1 blk=0 avail=6327 (53.9%) swpO=0 conn=4 myRSS=3082 php=0 phpRSS=0 ap=23 tcp=19 topuser=- 2026-08-24 21:56:08 L1=1.86 run=1 blk=0 avail=6347 (54.1%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=20 tcp=21 topuser=- 2026-08-24 21:56:16 L1=1.57 run=1 blk=0 avail=6375 (54.4%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-24 21:56:19 L1=1.57 run=1 blk=0 avail=6377 (54.4%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-24 21:56:26 L1=1.33 run=1 blk=0 avail=6379 (54.4%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-24 21:56:29 L1=1.33 run=1 blk=0 avail=6315 (53.8%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-24 21:56:36 L1=1.12 run=1 blk=0 avail=6382 (54.4%) swpO=0 conn=1 myRSS=3082 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-24 21:56:39 L1=1.12 run=2 blk=0 avail=6324 (53.9%) swpO=0 conn=2 myRSS=3082 php=1 phpRSS=87 ap=16 tcp=21 topuser=aaa 2026-08-24 21:56:46 L1=1.10 run=2 blk=0 avail=6294 (53.7%) swpO=0 conn=1 myRSS=3082 php=1 phpRSS=125 ap=15 tcp=21 topuser=madalice 2026-08-24 21:56:49 L1=1.10 run=1 blk=0 avail=6391 (54.5%) swpO=0 conn=2 myRSS=3082 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-24 21:56:56 L1=1.41 run=5 blk=0 avail=6281 (53.6%) swpO=0 conn=1 myRSS=3082 php=2 phpRSS=146 ap=19 tcp=26 topuser=madalice 2026-08-24 21:56:59 L1=1.41 run=4 blk=0 avail=6201 (52.9%) swpO=0 conn=2 myRSS=3082 php=3 phpRSS=237 ap=21 tcp=53 topuser=madalice 2026-08-24 21:57:06 L1=2.66 run=23 blk=0 avail=4938 (42.1%) swpO=2092 conn=10 myRSS=3023 php=13 phpRSS=1322 ap=37 tcp=49 topuser=madalice