INCIDENT 2026-08-26 20:18:33 trigger: swapout=2079/s ================================================================== load: 2.17 1.81 1.50 4/653 2563747 ncpu:10 mem_avail: 6347MB/11729MB (54.1%) swap_used:1570MB swapout:2079/s blocked(D):0 running:4 iowait:2.8% steal:0.0% php: 3 procs / 286MB heaviest user: madalice (2 procs, 220MB) apache: 77 procs tcp_estab: 57 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2395 nobody 76 1308 root 239 928 netdata 8 250 madalice 2 227 mailman 20 185 alison 3 97 cpanellogin 1 63 dovenull 6 46 wp-toolkit 6 19 dovecot 3 19 evolution 6 15 zabbix 1 13 kurri 1 7 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 2 228 alison 1 68 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3029 MB Active(file): 1844 MB Inactive(file): 1120 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 396 MB CommitLimit: 9960 MB Committed_AS: 8248 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2529365 root 09:52 65696 /opt/imunify360/venv/bin/python3 -m imav.run 2703186 root 19:07:16 2644 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2452516 15.9 Ssl 1-16:47:16 /usr/sbin/mariadbd 1220 1 netdata 197752 2.5 Ssl 58-10:08:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1065018 2938778 root 189752 0.1 S 07:06:28 spamd child 2956399 2938778 root 150572 0.0 S 17:48:34 spamd child 2563690 2563686 madalice 119448 86.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2563681 2562995 madalice 119272 89.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938778 1 root 93576 0.0 Ss 17:55:04 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2575382 1 root 92916 0.0 Ss 11-12:28:03 /usr/lib/systemd/systemd-journald 2563692 2563687 alison 72492 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2529365 1 root 65696 0.2 Ssl 09:52 /opt/imunify360/venv/bin/python3 -m imav.run 2244622 1353308 cpanellogin 64772 0.0 S 01:35:56 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 41400 0.0 Sl 58-10:08:41 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41100 0.0 Ss 35-17:37:12 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 32012 0.1 Sl 58-10:08:37 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 24696 0.1 Ss 58-10:08:41 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2546184 1276780 nobody 22732 0.0 S 05:18 /usr/sbin/httpd -k start 2544780 1276780 nobody 22024 0.0 S 07:35 /usr/sbin/httpd -k start 2546762 1276780 nobody 21816 0.0 S 04:05 /usr/sbin/httpd -k start 2561700 1276780 nobody 21436 0.0 S 02:20 /usr/sbin/httpd -k start 2546504 1276780 nobody 21000 0.0 S 04:38 /usr/sbin/httpd -k start 2544764 1276780 nobody 20924 0.0 S 07:36 /usr/sbin/httpd -k start 2562059 1276780 nobody 20848 0.2 S 02:05 /usr/sbin/httpd -k start 2558220 1276780 nobody 20776 0.0 S 03:23 /usr/sbin/httpd -k start 1463 1 root 20304 0.0 Ss 58-10:08:41 tailwatchd 2561265 1276780 nobody 19952 0.0 S 02:50 /usr/sbin/httpd -k start 185104 2431 netdata 19848 2.1 Rl 13-23:45:00 /usr/libexec/netdata/plugins.d/apps.plugin 1 2563317 1276780 nobody 19820 0.1 S 00:20 /usr/sbin/httpd -k start 2563322 1276780 nobody 19716 0.1 S 00:20 /usr/sbin/httpd -k start 2563263 1276780 nobody 19628 0.1 S 00:21 /usr/sbin/httpd -k start 2562995 1276780 nobody 19496 0.3 S 00:35 /usr/sbin/httpd -k start 2561200 1276780 nobody 19324 0.0 S 02:51 /usr/sbin/httpd -k start 2561266 1276780 nobody 19312 0.1 S 02:50 /usr/sbin/httpd -k start 2563315 1276780 nobody 19232 0.0 S 00:20 /usr/sbin/httpd -k start 2563303 1276780 nobody 19164 0.0 S 00:20 /usr/sbin/httpd -k start 2563268 1276780 nobody 19140 0.0 S 00:21 /usr/sbin/httpd -k start 2563305 1276780 nobody 19108 0.0 S 00:20 /usr/sbin/httpd -k start 2561264 1276780 nobody 18968 0.0 S 02:50 /usr/sbin/httpd -k start 2563313 1276780 nobody 18956 0.0 S 00:20 /usr/sbin/httpd -k start 2938201 1 root 18752 0.0 Ss 17:55:38 lfd - sleeping 2563314 1276780 nobody 18748 0.0 S 00:20 /usr/sbin/httpd -k start 2559808 1276780 nobody 18740 0.1 S 03:22 /usr/sbin/httpd -k start 2563301 1276780 nobody 18712 0.1 S 00:20 /usr/sbin/httpd -k start 2563270 1276780 nobody 18700 0.0 S 00:21 /usr/sbin/httpd -k start 2563335 1276780 nobody 18660 0.1 S 00:20 /usr/sbin/httpd -k start 2563304 1276780 nobody 18648 0.1 S 00:20 /usr/sbin/httpd -k start 2563273 1276780 nobody 18640 0.0 S 00:21 /usr/sbin/httpd -k start 2563310 1276780 nobody 18592 0.1 S 00:20 /usr/sbin/httpd -k start 2563271 1276780 nobody 18548 0.0 S 00:21 /usr/sbin/httpd -k start 2563325 1276780 nobody 18548 0.1 S 00:20 /usr/sbin/httpd -k start 2563269 1276780 nobody 18536 0.0 S 00:21 /usr/sbin/httpd -k start 2563266 1276780 nobody 18528 0.0 S 00:21 /usr/sbin/httpd -k start 2563332 1276780 nobody 18516 0.1 S 00:20 /usr/sbin/httpd -k start 2563307 1276780 nobody 18508 0.1 S 00:20 /usr/sbin/httpd -k start 2562758 1276780 nobody 18440 0.0 S 00:54 /usr/sbin/httpd -k start 2563308 1276780 nobody 18392 0.1 S 00:20 /usr/sbin/httpd -k start 2563336 1276780 nobody 18372 0.1 S 00:20 /usr/sbin/httpd -k start 2563272 1276780 nobody 18344 0.0 S 00:21 /usr/sbin/httpd -k start 2563312 1276780 nobody 18328 0.1 S 00:20 /usr/sbin/httpd -k start 2563267 1276780 nobody 18272 0.0 S 00:21 /usr/sbin/httpd -k start 2563311 1276780 nobody 18272 0.1 S 00:20 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 2563692 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8876840 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au-ssl_log 190 customc/customcentral.com.au-ssl_log 187 alison/alisonarts.com.au-ssl_log 126 speedlin/speedlinefencing.com.au 105 speedlin/speedlinefencing.com.au-ssl_log 101 kamcool/kamcool.com.au-ssl_log 81 madalice/madalice.com.au-ssl_log 80 evolution/evolutionerp.com.au-ssl_log 30 evolution/portal.evolutionerp.com.au-ssl_log 18 corpkicks/corporatekicks.com.au-ssl_log 16 tubesupplies/tubesupplies.com.au-ssl_log 9 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 203 82.102.18.222 190 158.23.184.117 117 74.248.24.12 115 20.203.141.11 81 158.23.147.79 68 4.204.200.136 57 20.220.10.235 28 136.109.175.228 18 203.54.180.238 16 52.139.37.240 7 118.127.40.55 3 2001:8003:cc23:a400:5dda:1b9b:445a:faf9 3 195.250.30.141 3 112.86.225.248 2 91.92.243.248 --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 13 GET / 9 POST /wp-login.php 6 POST /wp-cron.php 6 GET /wp-login.php 5 GET /wp.php 5 GET /admin.php 4 GET /wp-mail.php 4 GET /wp-cron.php 4 GET /wp-content/themes/index.php 4 GET /wp-content/cong.php 4 GET /wp-content/admin.php 4 GET /themes.php 4 GET /simple.php 4 GET /as.php 4 GET /about.php 4 GET /aaa.php 4 GET /404.php 4 GET /1.php 3 GET /x.php --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au-ssl_log == -- top paths -- 3 GET /post.php 2 GET /wp-includes/SimplePie/post.php 2 GET /wp-includes/post.php 2 GET /wp-includes/IXR/post.php 2 GET /wp-content/themes/post.php 2 GET /wp-content/plugins/post.php 2 GET /wp-content/languages/post.php 2 GET /wp-admin/maint/post.php 2 GET /wp-admin/includes/post.php 2 GET /wp-admin/images/xmrlpc.php 2 GET /wp-admin/images/post.php 2 GET /wp-admin/css/post.php -- last 10 requests -- 158.23.184.117 - - [26/Aug/2026:20:18:31 +1000] "GET /wp-admin/wp-admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [26/Aug/2026:20:18:31 +1000] "GET /wp-includes/Text/Diff/Engine/wp-login.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa 158.23.184.117 - - [26/Aug/2026:20:18:31 +1000] "GET /wp-mail.php/wp-includes/ID3/getid3s.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safa 158.23.184.117 - - [26/Aug/2026:20:18:32 +1000] "GET /wp-content/batm.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [26/Aug/2026:20:18:32 +1000] "GET /wp-content/403.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [26/Aug/2026:20:18:32 +1000] "GET /wp-admin/product.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [26/Aug/2026:20:18:33 +1000] "GET /wp-content/uploads/autoload_classmap.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar 158.23.184.117 - - [26/Aug/2026:20:18:33 +1000] "GET /moon.php?p= HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [26/Aug/2026:20:18:33 +1000] "GET /wp-admin/user/post.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [26/Aug/2026:20:18:33 +1000] "GET /wp-includes/theme-compat/post.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 == customc/customcentral.com.au-ssl_log == -- top paths -- 3 GET /admin.php 3 GET /about.php 3 GET /aaa.php 2 GET /wp-login.php 2 GET /wp-cron.php 2 GET /wp-content/uploads/ 2 GET /wp-content/themes/index.php 2 GET /wp-content/admin.php 2 GET /wp-admin/css/colors/modern/ 2 GET /term.php 2 GET /simple.php 2 GET /abcd.php -- last 10 requests -- 74.248.24.12 - - [26/Aug/2026:20:18:15 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:15 +1000] "GET /zup.php73 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:16 +1000] "GET /k.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:16 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:16 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:17 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:17 +1000] "GET /wp-content/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:17 +1000] "GET /ww5.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:17 +1000] "GET /2.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [26/Aug/2026:20:18:18 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /gallery/spider-on-skull-guitar/ 2 GET /airbrushing/nggallery/helmets/skate-helmet 2 GET /airbrushing/nggallery/helmets/jetski-helmet 2 GET / 1 POST /wp-login.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php -- last 10 requests -- 20.203.141.11 - - [26/Aug/2026:20:18:24 +1000] "GET /ncx.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:25 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:25 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:25 +1000] "GET /zup.php73 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:26 +1000] "GET /k.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:26 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:26 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:27 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:27 +1000] "GET /wp-content/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [26/Aug/2026:20:18:27 +1000] "GET /ww5.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-26 20:16:12 L1=2.27 run=6 blk=0 avail=6490 (55.3%) swpO=0 conn=5 myRSS=2397 php=4 phpRSS=540 ap=21 tcp=27 topuser=madalice 2026-08-26 20:16:12 L1=2.27 run=4 blk=0 avail=6484 (55.3%) swpO=0 conn=3 myRSS=2397 php=4 phpRSS=544 ap=21 tcp=27 topuser=madalice 2026-08-26 20:16:22 L1=2.63 run=3 blk=0 avail=6485 (55.3%) swpO=0 conn=5 myRSS=2397 php=2 phpRSS=486 ap=22 tcp=26 topuser=madalice 2026-08-26 20:16:22 L1=2.63 run=4 blk=0 avail=6475 (55.2%) swpO=0 conn=3 myRSS=2397 php=2 phpRSS=493 ap=22 tcp=25 topuser=madalice 2026-08-26 20:16:32 L1=2.60 run=2 blk=0 avail=6817 (58.1%) swpO=0 conn=5 myRSS=2397 php=1 phpRSS=93 ap=25 tcp=29 topuser=madalice 2026-08-26 20:16:32 L1=2.60 run=3 blk=0 avail=6815 (58.1%) swpO=0 conn=3 myRSS=2397 php=1 phpRSS=95 ap=25 tcp=29 topuser=madalice 2026-08-26 20:16:42 L1=2.35 run=3 blk=0 avail=6722 (57.3%) swpO=1 conn=2 myRSS=2397 php=1 phpRSS=204 ap=23 tcp=27 topuser=madalice 2026-08-26 20:16:42 L1=2.35 run=3 blk=0 avail=6717 (57.3%) swpO=1 conn=3 myRSS=2397 php=1 phpRSS=209 ap=23 tcp=27 topuser=madalice 2026-08-26 20:16:52 L1=2.14 run=3 blk=0 avail=6774 (57.8%) swpO=0 conn=2 myRSS=2397 php=2 phpRSS=179 ap=23 tcp=27 topuser=madalice 2026-08-26 20:16:52 L1=2.14 run=5 blk=0 avail=6768 (57.7%) swpO=0 conn=3 myRSS=2397 php=3 phpRSS=220 ap=23 tcp=27 topuser=madalice 2026-08-26 20:17:02 L1=1.81 run=5 blk=0 avail=6857 (58.5%) swpO=0 conn=2 myRSS=2397 php=2 phpRSS=126 ap=21 tcp=21 topuser=speedlin 2026-08-26 20:17:02 L1=1.81 run=3 blk=0 avail=6838 (58.3%) swpO=0 conn=3 myRSS=2397 php=2 phpRSS=146 ap=21 tcp=21 topuser=speedlin 2026-08-26 20:17:12 L1=1.93 run=2 blk=0 avail=6771 (57.7%) swpO=0 conn=2 myRSS=2397 php=1 phpRSS=174 ap=22 tcp=23 topuser=madalice 2026-08-26 20:17:12 L1=1.93 run=2 blk=0 avail=6766 (57.7%) swpO=0 conn=3 myRSS=2397 php=1 phpRSS=178 ap=22 tcp=23 topuser=madalice 2026-08-26 20:17:22 L1=1.86 run=3 blk=0 avail=6670 (56.9%) swpO=0 conn=2 myRSS=2397 php=3 phpRSS=312 ap=22 tcp=30 topuser=speedlin 2026-08-26 20:17:22 L1=1.86 run=3 blk=0 avail=6664 (56.8%) swpO=0 conn=3 myRSS=2397 php=3 phpRSS=320 ap=22 tcp=30 topuser=speedlin 2026-08-26 20:17:32 L1=1.73 run=3 blk=0 avail=6663 (56.8%) swpO=0 conn=2 myRSS=2397 php=2 phpRSS=323 ap=18 tcp=25 topuser=madalice 2026-08-26 20:17:32 L1=1.73 run=3 blk=0 avail=6702 (57.1%) swpO=0 conn=3 myRSS=2397 php=2 phpRSS=91 ap=18 tcp=25 topuser=alison 2026-08-26 20:17:42 L1=1.78 run=4 blk=0 avail=6572 (56.0%) swpO=0 conn=5 myRSS=2397 php=4 phpRSS=470 ap=20 tcp=30 topuser=aaa 2026-08-26 20:17:43 L1=1.78 run=4 blk=0 avail=6554 (55.9%) swpO=0 conn=3 myRSS=2397 php=4 phpRSS=474 ap=20 tcp=28 topuser=aaa 2026-08-26 20:17:53 L1=1.74 run=2 blk=0 avail=6870 (58.6%) swpO=0 conn=5 myRSS=2397 php=1 phpRSS=79 ap=20 tcp=27 topuser=madalice 2026-08-26 20:17:53 L1=1.74 run=2 blk=0 avail=6866 (58.5%) swpO=0 conn=2 myRSS=2397 php=1 phpRSS=82 ap=20 tcp=27 topuser=madalice 2026-08-26 20:18:03 L1=1.62 run=3 blk=0 avail=6809 (58.1%) swpO=0 conn=5 myRSS=2397 php=2 phpRSS=159 ap=23 tcp=30 topuser=madalice 2026-08-26 20:18:03 L1=1.62 run=3 blk=0 avail=6799 (58.0%) swpO=0 conn=2 myRSS=2397 php=2 phpRSS=165 ap=23 tcp=30 topuser=madalice 2026-08-26 20:18:13 L1=1.68 run=2 blk=0 avail=6590 (56.2%) swpO=0 conn=5 myRSS=2397 php=1 phpRSS=121 ap=54 tcp=89 topuser=madalice 2026-08-26 20:18:13 L1=1.68 run=7 blk=0 avail=6553 (55.9%) swpO=0 conn=2 myRSS=2397 php=1 phpRSS=125 ap=86 tcp=89 topuser=madalice 2026-08-26 20:18:23 L1=2.20 run=9 blk=0 avail=6120 (52.2%) swpO=0 conn=5 myRSS=2397 php=4 phpRSS=514 ap=77 tcp=41 topuser=corpkicks 2026-08-26 20:18:23 L1=2.20 run=6 blk=0 avail=6105 (52.1%) swpO=0 conn=2 myRSS=2397 php=4 phpRSS=533 ap=77 tcp=41 topuser=corpkicks 2026-08-26 20:18:33 L1=2.17 run=4 blk=0 avail=6347 (54.1%) swpO=2079 conn=4 myRSS=2395 php=3 phpRSS=286 ap=77 tcp=57 topuser=madalice 2026-08-26 20:18:33 L1=2.17 run=5 blk=1 avail=6343 (54.1%) swpO=2079 conn=4 myRSS=2395 php=3 phpRSS=290 ap=77 tcp=57 topuser=madalice