INCIDENT 2026-08-25 03:28:16 trigger: php_rss=2407MB mysql_conn=17 ================================================================== load: 2.33 1.08 1.03 18/686 2361363 ncpu:10 mem_avail: 4485MB/11729MB (38.2%) swap_used:3875MB swapout:0/s blocked(D):0 running:21 iowait:0.0% steal:0.0% php: 16 procs / 2407MB heaviest user: madalice (16 procs, 2407MB) apache: 45 procs tcp_estab: 79 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2774 madalice 16 2652 root 252 1092 nobody 44 614 netdata 8 269 mailman 20 93 dovenull 6 66 cpanellogin 1 61 mailnull 4 45 lowrange 2 29 dovecot 3 29 kurri 2 27 wp-toolkit 6 19 aaa 1 15 zabbix 1 14 vinesit 1 14 infinium 1 14 corpkicks 1 14 evolution 4 12 named 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 16 2695 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4805 MB Active(file): 2747 MB Inactive(file): 690 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 401 MB CommitLimit: 9960 MB Committed_AS: 10019 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1913717 root 02:16:59 5444 /usr/bin/imunify-agent-proxy 2361175 root 00:16 3104 /bin/bash /etc/cron.daily/imunify-antivirus.cron 2361176 root 00:16 1292 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 2361177 root 00:16 8300 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 2361188 root 00:16 14536 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2841024 9.8 Ssl 9-19:37:43 /usr/sbin/mariadbd 2361304 2361296 madalice 270432 81.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361305 2361297 madalice 267516 80.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361303 2361295 madalice 222140 67.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361291 2361287 madalice 218252 67.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 216176 2.5 Ssl 56-17:18:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2361310 2361301 madalice 211108 65.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361307 2361302 madalice 202580 62.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361294 2361288 madalice 198704 60.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361292 2361286 madalice 196248 60.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2160755 2145741 root 184772 0.0 S 01:02:52 spamd child 2361309 2361298 madalice 179348 51.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2145741 1 root 176112 0.1 Ss 01:05:14 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2160756 2145741 root 168584 0.0 S 01:02:52 spamd child 2361306 2361300 madalice 167084 57.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 147080 0.0 Ss 9-19:37:46 /usr/lib/systemd/systemd-journald 2361308 2361299 madalice 135036 37.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361332 2361282 madalice 116644 91.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361330 2361316 madalice 106460 37.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361331 2295082 madalice 97428 61.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2361333 2328891 madalice 93012 51.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2244527 1353308 cpanellogin 62728 0.0 S 36:36 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 42680 0.0 Sl 56-17:18:24 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40972 0.0 Ss 34-00:46:55 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 34996 0.1 Sl 56-17:18:20 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 31888 0.1 Ss 56-17:18:24 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2144580 1 root 30656 0.0 Ss 01:06:03 lfd - sleeping 2342578 2342528 root 25052 0.0 S 07:44 /usr/sbin/exim -q 2345291 1276780 nobody 23824 0.0 S 03:29 /usr/sbin/httpd -k start 2342735 1276780 nobody 23768 0.0 S 07:22 /usr/sbin/httpd -k start 2326380 1276780 nobody 23528 0.0 S 11:42 /usr/sbin/httpd -k start 1463 1 root 23312 0.0 Ss 56-17:18:24 tailwatchd 2328891 1276780 nobody 23260 0.0 S 08:16 /usr/sbin/httpd -k start 2327803 1276780 nobody 22660 0.0 S 09:36 /usr/sbin/httpd -k start 2342753 1276780 nobody 21656 0.0 S 07:18 /usr/sbin/httpd -k start 2359116 1276780 nobody 20944 0.0 S 02:59 /usr/sbin/httpd -k start 2342580 2342578 mailnull 20804 0.0 S 07:44 /usr/sbin/exim -q 2345246 1276780 nobody 19952 0.0 S 03:34 /usr/sbin/httpd -k start 2359470 1276780 nobody 19236 0.0 S 02:24 /usr/sbin/httpd -k start 2361282 1276780 nobody 19180 0.4 S 00:05 /usr/sbin/httpd -k start 2361283 1276780 nobody 19032 0.2 S 00:05 /usr/sbin/httpd -k start 2361296 1276780 nobody 18968 0.0 S 00:03 /usr/sbin/httpd -k start 2361289 1276780 nobody 18964 0.5 S 00:04 /usr/sbin/httpd -k start 2360897 1276780 nobody 18904 0.0 S 00:35 /usr/sbin/httpd -k start 2361253 1276780 nobody 18868 0.1 S 00:06 /usr/sbin/httpd -k start 185104 2431 netdata 18276 2.1 Sl 12-06:54:43 /usr/libexec/netdata/plugins.d/apps.plugin 1 2295082 1276780 nobody 18112 0.0 S 18:37 /usr/sbin/httpd -k start 1780161 3828812 root 17140 0.0 S 02:55:25 dovecot/config 2326909 1471 root 16708 0.0 S 11:04 cPhulkd - dbprocessor 2361286 1276780 nobody 16616 0.0 S 00:04 /usr/sbin/httpd -k start 2361288 1276780 nobody 16616 0.0 S 00:04 /usr/sbin/httpd -k start 2361297 1276780 nobody 16616 0.3 S 00:03 /usr/sbin/httpd -k start 2361287 1276780 nobody 16552 0.2 S 00:04 /usr/sbin/httpd -k start 2361295 1276780 nobody 16552 0.3 S 00:03 /usr/sbin/httpd -k start 2361298 1276780 nobody 16552 0.0 S 00:03 /usr/sbin/httpd -k start 2361299 1276780 nobody 16552 0.0 S 00:03 /usr/sbin/httpd -k start 2361300 1276780 nobody 16552 0.3 S 00:03 /usr/sbin/httpd -k start 2361316 1276780 nobody 16524 0.0 S 00:02 /usr/sbin/httpd -k start 2361302 1276780 nobody 16488 0.0 S 00:03 /usr/sbin/httpd -k start 2361301 1276780 nobody 16472 0.0 S 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 28127725 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au-ssl_log 179 aaa/aaadownunder.com.au-ssl_log 102 tubesupplies/tubesupplies.com.au-ssl_log 80 madalice/madalice.com.au-ssl_log 22 evolution/portal.evolutionerp.com.au-ssl_log 9 corpkicks/corporatekicks.com.au-ssl_log 3 evolution/evolutionerp.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 lowrange/lowrange.com.au 2 speedlin/speedlinefencing.com.au-ssl_log 2 alison/alisonarts.com.au-ssl_log 1 alison/testing.alisonarts.com.au 1 alison/testing.alisonarts.com.au-ssl_log 1 cosgrovecreative/cosgrovecreative.com.au 1 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 179 158.23.147.79 100 52.139.37.240 79 20.48.160.90 15 34.138.72.131 9 203.54.180.238 6 118.127.40.55 3 136.119.67.202 2 192.168.0.2 2 114.119.137.101 1 93.123.109.101 1 91.92.243.251 1 91.92.243.239 1 54.208.198.119 1 52.167.144.209 1 52.167.144.161 --- top request paths across all vhosts (last 3 min) --- 12 GET / 9 GET /heartbeat.php 5 POST /wp-cron.php 4 GET /aab9 3 GET /wp.php 3 GET /store/custom-wests-tigers-kids/ 3 GET /getcmd 3 GET /atomlib.php 3 GET /admin.php 3 GET /aaa9 2 POST /wp-login.php 2 GET /wp-mail.php 2 GET /wp-login.php 2 GET /wp-includes/fonts/index.php 2 GET /wp-content/uploads/ 2 GET /wp-content/themes/index.php 2 GET /wp-content/index.php 2 GET /wp-content/admin.php 2 GET /wp-admin/ 2 GET /.well-known/ --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/theme-compat/about.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/index.php -- last 10 requests -- 158.23.147.79 - - [25/Aug/2026:03:27:29 +1000] "GET /wp-admin/users.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:29 +1000] "GET /defaults.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:30 +1000] "GET /wp-includes/blocks/about.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:31 +1000] "GET /wp-includes/Text/about.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:31 +1000] "GET /wp-content/themes/wp-pridmag/init.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:32 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:32 +1000] "GET /wp-includes/plugins.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:33 +1000] "GET /wp-content/upgrade/wp-login.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:33 +1000] "GET /wp-includes/certificates/wp-login.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [25/Aug/2026:03:27:34 +1000] "GET /wp-admin/css/network.php HTTP/1.1" 401 36 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php -- last 10 requests -- 52.139.37.240 - - [25/Aug/2026:03:26:58 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:26:59 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:26:59 +1000] "GET /wp-content/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:27:00 +1000] "GET /ww5.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:27:00 +1000] "GET /2.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:27:01 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:27:01 +1000] "GET /atomlib.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:27:02 +1000] "GET /rip.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:27:03 +1000] "GET /p.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:03:27:03 +1000] "GET /php.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /admin.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /ws85.php 1 GET /wpxml.php 1 GET /wp.php 1 GET /waff.php 1 GET /w3lls.php 1 GET /w3llscc.php 1 GET /vpn.php 1 GET /user3.php -- last 10 requests -- 20.48.160.90 - - [25/Aug/2026:03:26:32 +1000] "GET /vpn.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:33 +1000] "GET /shiny.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:33 +1000] "GET /goods.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:34 +1000] "GET /user3.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:34 +1000] "GET /waff.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:35 +1000] "GET /33.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:35 +1000] "GET /133.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:36 +1000] "GET /sym.php HTTP/1.1" 401 36 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:26:36 +1000] "GET /8.php HTTP/1.1" 401 36 "-" "-" 93.123.109.101 - - [25/Aug/2026:03:27:34 +1000] "GET / HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-25 03:25:51 L1=0.59 run=2 blk=0 avail=6515 (55.6%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=16 tcp=30 topuser=- 2026-08-25 03:25:55 L1=0.54 run=2 blk=0 avail=6349 (54.1%) swpO=0 conn=2 myRSS=2774 php=1 phpRSS=145 ap=22 tcp=30 topuser=madalice 2026-08-25 03:26:01 L1=0.50 run=3 blk=0 avail=6464 (55.1%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=22 tcp=26 topuser=- 2026-08-25 03:26:05 L1=0.45 run=2 blk=0 avail=6485 (55.3%) swpO=0 conn=2 myRSS=2774 php=0 phpRSS=0 ap=18 tcp=23 topuser=- 2026-08-25 03:26:11 L1=0.42 run=1 blk=0 avail=6488 (55.3%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=18 tcp=23 topuser=- 2026-08-25 03:26:15 L1=0.47 run=2 blk=0 avail=6449 (55.0%) swpO=0 conn=2 myRSS=2774 php=1 phpRSS=61 ap=18 tcp=25 topuser=alison 2026-08-25 03:26:21 L1=0.43 run=2 blk=0 avail=6457 (55.1%) swpO=1 conn=1 myRSS=2774 php=1 phpRSS=59 ap=18 tcp=27 topuser=madalice 2026-08-25 03:26:25 L1=0.47 run=1 blk=0 avail=6480 (55.2%) swpO=1 conn=2 myRSS=2774 php=0 phpRSS=0 ap=18 tcp=26 topuser=- 2026-08-25 03:26:31 L1=0.44 run=2 blk=0 avail=6482 (55.3%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-25 03:26:35 L1=0.40 run=1 blk=0 avail=6485 (55.3%) swpO=0 conn=2 myRSS=2774 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-25 03:26:41 L1=0.37 run=1 blk=0 avail=6492 (55.4%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-25 03:26:45 L1=0.42 run=1 blk=0 avail=6487 (55.3%) swpO=0 conn=2 myRSS=2774 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-25 03:26:51 L1=0.47 run=1 blk=0 avail=6501 (55.4%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-25 03:26:55 L1=0.43 run=1 blk=0 avail=6504 (55.5%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-25 03:27:01 L1=0.39 run=1 blk=0 avail=6510 (55.5%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-25 03:27:05 L1=0.36 run=1 blk=0 avail=6505 (55.5%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-25 03:27:11 L1=0.57 run=1 blk=0 avail=6506 (55.5%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-25 03:27:16 L1=0.69 run=3 blk=0 avail=6371 (54.3%) swpO=0 conn=1 myRSS=2774 php=1 phpRSS=168 ap=15 tcp=22 topuser=madalice 2026-08-25 03:27:21 L1=0.79 run=1 blk=0 avail=6509 (55.5%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-25 03:27:26 L1=0.89 run=1 blk=0 avail=6508 (55.5%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-25 03:27:31 L1=0.90 run=1 blk=0 avail=6516 (55.6%) swpO=2 conn=1 myRSS=2774 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-25 03:27:36 L1=0.91 run=1 blk=0 avail=6507 (55.5%) swpO=2 conn=1 myRSS=2774 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-25 03:27:41 L1=0.91 run=5 blk=0 avail=6398 (54.5%) swpO=2 conn=1 myRSS=2774 php=3 phpRSS=200 ap=15 tcp=28 topuser=tubesupplies 2026-08-25 03:27:46 L1=1.08 run=2 blk=0 avail=6374 (54.3%) swpO=2 conn=1 myRSS=2774 php=1 phpRSS=156 ap=16 tcp=24 topuser=customc 2026-08-25 03:27:51 L1=1.08 run=1 blk=0 avail=6505 (55.5%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-25 03:27:56 L1=1.07 run=2 blk=0 avail=6502 (55.4%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=14 tcp=19 topuser=- 2026-08-25 03:28:01 L1=1.06 run=1 blk=0 avail=6503 (55.4%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-25 03:28:06 L1=1.06 run=1 blk=0 avail=6501 (55.4%) swpO=0 conn=1 myRSS=2774 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-25 03:28:11 L1=1.05 run=10 blk=0 avail=5795 (49.4%) swpO=0 conn=9 myRSS=2774 php=8 phpRSS=952 ap=15 tcp=83 topuser=madalice 2026-08-25 03:28:16 L1=2.33 run=21 blk=0 avail=4485 (38.2%) swpO=0 conn=17 myRSS=2774 php=16 phpRSS=2407 ap=45 tcp=79 topuser=madalice