INCIDENT 2026-08-26 21:00:55 trigger: php_procs=27 php_rss=3019MB mysql_conn=23 ================================================================== load: 6.43 2.48 1.68 28/669 2714982 ncpu:10 mem_avail: 4242MB/11729MB (36.2%) swap_used:1586MB swapout:892/s blocked(D):0 running:33 iowait:0.1% steal:0.0% php: 27 procs / 3019MB heaviest user: tubesupplies (25 procs, 2890MB) apache: 74 procs tcp_estab: 75 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2473 tubesupplies 22 2375 nobody 73 1047 root 240 832 netdata 8 256 mailman 20 181 madalice 1 71 cpanellogin 1 62 vinesit 1 59 dovenull 6 46 wp-toolkit 6 19 dovecot 3 19 evolution 7 17 alison 1 15 zabbix 1 13 mailnull 2 9 kurri 1 7 named 1 6 nscd 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB tubesupplies 21 2227 madalice 1 71 vinesit 1 62 evolution 1 7 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4898 MB Active(file): 3115 MB Inactive(file): 738 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 396 MB CommitLimit: 9960 MB Committed_AS: 10467 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2700832 root 00:55 1336 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 2703186 root 19:49:39 2840 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2532748 15.7 Ssl 1-17:29:39 /usr/sbin/mariadbd 1220 1 netdata 203436 2.5 Ssl 58-10:51:05 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1065018 2938778 root 188964 0.1 S 07:48:51 spamd child 2714880 2698714 tubesupplies 153760 29.4 S 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714897 2698733 tubesupplies 151228 27.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2956399 2938778 root 150520 0.0 S 18:30:57 spamd child 2714891 2714769 tubesupplies 149616 28.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714896 2714758 tubesupplies 147056 26.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714877 2714761 tubesupplies 145444 22.1 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714879 2698096 tubesupplies 139284 29.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714919 2714909 tubesupplies 124584 58.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714893 2714733 tubesupplies 117376 23.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 106468 0.0 Ss 11-13:10:26 /usr/lib/systemd/systemd-journald 2714929 2698669 tubesupplies 94532 36.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938778 1 root 93560 0.0 Ss 18:37:27 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2714930 2698764 tubesupplies 91976 36.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714931 2714863 tubesupplies 91848 39.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714920 2714910 tubesupplies 81384 26.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714951 2714934 vinesit 78296 41.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714949 2714904 tubesupplies 77288 52.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2714933 2714928 madalice 76604 43.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2244622 1353308 cpanellogin 64188 0.0 S 02:18:19 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2715001 2714926 speedlin 47292 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 41400 0.0 Sl 58-10:51:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40884 0.0 Ss 35-18:19:35 cpsrvd (SSL) - waiting for connections 2714979 2714924 evolution 40864 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 32300 0.1 Sl 58-10:51:00 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 24440 0.1 Ss 58-10:51:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2698096 1276780 nobody 24052 0.0 R 05:10 /usr/sbin/httpd -k start 2698682 1276780 nobody 22304 0.0 S 04:16 /usr/sbin/httpd -k start 2698676 1276780 nobody 21656 0.0 S 04:16 /usr/sbin/httpd -k start 2698651 1276780 nobody 21520 0.0 S 04:18 /usr/sbin/httpd -k start 2698659 1276780 nobody 20676 0.1 S 04:17 /usr/sbin/httpd -k start 2698764 1276780 nobody 20676 0.0 S 04:14 /usr/sbin/httpd -k start 2698742 1276780 nobody 20388 0.0 S 04:15 /usr/sbin/httpd -k start 2698733 1276780 nobody 20328 0.0 S 04:15 /usr/sbin/httpd -k start 2698669 1276780 nobody 20172 0.0 S 04:17 /usr/sbin/httpd -k start 2698677 1276780 nobody 20164 0.0 S 04:16 /usr/sbin/httpd -k start 2698714 1276780 nobody 20064 0.0 S 04:15 /usr/sbin/httpd -k start 1463 1 root 20016 0.0 Ss 58-10:51:04 tailwatchd 2698702 1276780 nobody 19812 0.0 S 04:16 /usr/sbin/httpd -k start 185104 2431 netdata 19700 2.1 Sl 14-00:27:23 /usr/libexec/netdata/plugins.d/apps.plugin 1 2698740 1276780 nobody 18764 0.0 S 04:15 /usr/sbin/httpd -k start 2938201 1 root 18272 0.0 Ss 18:38:01 lfd - sleeping 2714769 1276780 nobody 18228 0.1 S 00:17 /usr/sbin/httpd -k start 2698775 1276780 nobody 18056 0.0 S 04:14 /usr/sbin/httpd -k start 2698748 1276780 nobody 17892 0.0 S 04:14 /usr/sbin/httpd -k start 2714681 1276780 nobody 17532 0.0 S 00:21 /usr/sbin/httpd -k start 2714761 1276780 nobody 17360 0.0 S 00:17 /usr/sbin/httpd -k start 2714760 1276780 nobody 17336 0.0 S 00:17 /usr/sbin/httpd -k start 2714742 1276780 nobody 16856 0.0 S 00:19 /usr/sbin/httpd -k start 2714743 1276780 nobody 16756 0.0 S 00:19 /usr/sbin/httpd -k start 2714756 1276780 nobody 16756 0.0 S 00:18 /usr/sbin/httpd -k start 2714754 1276780 nobody 16744 0.0 S 00:18 /usr/sbin/httpd -k start 2714752 1276780 nobody 16700 0.0 S 00:18 /usr/sbin/httpd -k start 2714758 1276780 nobody 16688 0.0 S 00:18 /usr/sbin/httpd -k start 2714751 1276780 nobody 16672 0.0 S 00:18 /usr/sbin/httpd -k start 2714753 1276780 nobody 16672 0.0 S 00:18 /usr/sbin/httpd -k start 2714734 1276780 nobody 16632 0.0 S 00:20 /usr/sbin/httpd -k start 2714733 1276780 nobody 16616 0.0 S 00:20 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8890884 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 247 corpkicks/corporatekicks.com.au-ssl_log 159 corpkicks/corporatekicks.com.au 135 speedlin/speedlinefencing.com.au-ssl_log 101 speedlin/speedlinefencing.com.au 98 lowrange/lowrange.com.au 69 evolution/portal.evolutionerp.com.au-ssl_log 30 kamcool/kamcool.com.au 30 evolution/my.evolutionerp.com.au-ssl_log 16 aaa/aaadownunder.com.au-ssl_log 10 infinium/infinium.net.au-ssl_log 10 alison/alisonarts.com.au-ssl_log 9 kamcool/kamcool.com.au-ssl_log 8 madalice/madalice.com.au-ssl_log 8 corpkicks/2025.corporatekicks.com.au-ssl_log 3 (total vhosts taking traffic: 21) --- top client IPs across all vhosts (last 3 min) --- 268 20.104.104.62 196 82.102.18.222 123 34.158.61.4 121 20.100.175.163 69 4.204.200.136 30 203.54.180.238 30 20.151.129.194 14 216.73.216.31 12 118.127.40.55 7 202.153.211.134 4 94.154.43.135 3 94.154.43.129 3 94.154.43.125 3 206.83.113.169 3 185.247.137.10 --- top request paths across all vhosts (last 3 min) --- 30 GET /heartbeat.php 26 GET / 14 GET /fetch 12 POST /wp-cron.php 10 POST /wp-login.php 10 POST /functions.php 4 GET /wp-content/themes/index.php 4 GET /4PJcpMFsD8B.php 4 GET /3PJcpMFsD8B.php 4 GET /222.php 3 POST /clienteditsave.php 3 GET /zoo2.php 3 GET /wp-login.php 3 GET /wp-content/index.php 3 GET /wp-content/cong.php 3 GET /wp-admin/js/index.php 3 GET /simple.php 3 GET /reviall.php 3 GET /read 3 GET /php.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 14 GET /fetch 6 GET / 3 POST /wp-login.php 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /@fs/root/.aws/credentials 2 GET /@fs/proc/1/environ 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /@fs/etc/passwd 1 POST /wp-cron.php 1 POST /v1/graphql -- last 10 requests -- 34.158.61.4 - - [26/Aug/2026:21:00:50 +1000] "GET /.github/.env HTTP/1.1" 404 152099 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.158.61.4 - - [26/Aug/2026:21:00:50 +1000] "GET /.git/config HTTP/1.1" 404 152272 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/6 34.158.61.4 - - [26/Aug/2026:21:00:51 +1000] "GET /_profiler/phpinfo HTTP/1.1" 404 152091 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot)" 34.158.61.4 - - [26/Aug/2026:21:00:51 +1000] "GET /download?file=../../.aws/credentials HTTP/1.1" 404 152095 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; LinkedInBot/1.0; +http://www.linkedin.com)" 34.158.61.4 - - [26/Aug/2026:21:00:50 +1000] "GET /debug/pprof/cmdline HTTP/1.1" 404 152094 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonb 34.158.61.4 - - [26/Aug/2026:21:00:51 +1000] "GET /read?file=../../.env HTTP/1.1" 404 152091 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.158.61.4 - - [26/Aug/2026:21:00:54 +1000] "GET /fetch?target=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F HTTP/1.1" 404 152088 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck 34.158.61.4 - - [26/Aug/2026:21:00:50 +1000] "GET /@fs/proc/1/environ?import&raw?? HTTP/1.1" 404 152094 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; facebookexternalhi 34.158.61.4 - - [26/Aug/2026:21:00:54 +1000] "GET /fetch?target=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Finfo HTTP/1.1" 404 152097 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KH 34.158.61.4 - - [26/Aug/2026:21:00:54 +1000] "GET /?file=..%2F..%2F.env HTTP/1.1" 200 352580 "https://tubesupplies.com.au/?file=../../.env" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko; == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 3 POST /wp-cron.php 1 HEAD / 1 GET /Zoo.php 1 GET /zoo2.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /xwpg.php 1 GET /xty.php 1 GET /x1da.php 1 GET /ws77.php 1 GET /wpxml.php 1 GET /wp-wlx.php -- last 10 requests -- 20.104.104.62 - - [26/Aug/2026:21:00:22 +1000] "GET /cok.php HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:23 +1000] "GET /wg459o.php HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:24 +1000] "GET /wp-content/uploads/panel.php HTTP/1.1" 403 12 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:25 +1000] "GET /gecko-new.php HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:26 +1000] "GET /sxxb.php HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:27 +1000] "GET /ws77.php HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:28 +1000] "GET /fling.php?p= HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:29 +1000] "GET /kj.php HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:30 +1000] "GET /crgio.php HTTP/1.1" 403 6789 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:32 +1000] "GET /css.php HTTP/1.1" 403 6789 "-" "-" == corpkicks/corporatekicks.com.au == -- top paths -- 1 GET /Zoo.php 1 GET /zoo2.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /xwpg.php 1 GET /xty.php 1 GET /x1da.php 1 GET /ws77.php 1 GET /wpxml.php 1 GET /wp-wlx.php 1 GET /wpupex.php 1 GET /wp-rrtx.php -- last 10 requests -- 20.104.104.62 - - [26/Aug/2026:21:00:23 +1000] "GET /wg459o.php HTTP/1.1" 301 288 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:24 +1000] "GET /wp-content/uploads/panel.php HTTP/1.1" 301 306 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:24 +1000] "GET /gecko-new.php HTTP/1.1" 301 291 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:25 +1000] "GET /sxxb.php HTTP/1.1" 301 286 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:27 +1000] "GET /ws77.php HTTP/1.1" 301 286 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:28 +1000] "GET /fling.php?p= HTTP/1.1" 301 290 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:29 +1000] "GET /kj.php HTTP/1.1" 301 284 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:30 +1000] "GET /crgio.php HTTP/1.1" 301 287 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:31 +1000] "GET /css.php HTTP/1.1" 301 285 "-" "-" 20.104.104.62 - - [26/Aug/2026:21:00:32 +1000] "GET /wp-content/xyn.php HTTP/1.1" 301 296 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-26 20:58:35 L1=1.45 run=2 blk=0 avail=6780 (57.8%) swpO=1 conn=4 myRSS=2493 php=2 phpRSS=94 ap=34 tcp=23 topuser=corpkicks 2026-08-26 20:58:35 L1=1.45 run=3 blk=0 avail=6664 (56.8%) swpO=1 conn=3 myRSS=2493 php=3 phpRSS=248 ap=33 tcp=23 topuser=corpkicks 2026-08-26 20:58:45 L1=1.67 run=2 blk=0 avail=6763 (57.7%) swpO=0 conn=4 myRSS=2493 php=2 phpRSS=159 ap=27 tcp=26 topuser=corpkicks 2026-08-26 20:58:45 L1=1.67 run=2 blk=0 avail=6845 (58.4%) swpO=0 conn=3 myRSS=2493 php=2 phpRSS=77 ap=26 tcp=26 topuser=evolution 2026-08-26 20:58:55 L1=1.57 run=3 blk=0 avail=6629 (56.5%) swpO=0 conn=4 myRSS=2493 php=3 phpRSS=335 ap=23 tcp=24 topuser=corpkicks 2026-08-26 20:58:55 L1=1.57 run=4 blk=0 avail=6476 (55.2%) swpO=0 conn=3 myRSS=2493 php=5 phpRSS=551 ap=23 tcp=25 topuser=corpkicks 2026-08-26 20:59:05 L1=1.48 run=1 blk=0 avail=6881 (58.7%) swpO=0 conn=4 myRSS=2493 php=1 phpRSS=39 ap=21 tcp=23 topuser=evolution 2026-08-26 20:59:05 L1=1.48 run=2 blk=0 avail=6867 (58.6%) swpO=0 conn=2 myRSS=2493 php=2 phpRSS=85 ap=20 tcp=22 topuser=corpkicks 2026-08-26 20:59:15 L1=1.57 run=4 blk=0 avail=6672 (56.9%) swpO=0 conn=4 myRSS=2493 php=3 phpRSS=316 ap=19 tcp=21 topuser=madalice 2026-08-26 20:59:15 L1=1.57 run=4 blk=0 avail=6482 (55.3%) swpO=0 conn=2 myRSS=2493 php=4 phpRSS=440 ap=19 tcp=23 topuser=infinium 2026-08-26 20:59:25 L1=1.56 run=2 blk=0 avail=6795 (57.9%) swpO=0 conn=4 myRSS=2493 php=2 phpRSS=174 ap=18 tcp=21 topuser=corpkicks 2026-08-26 20:59:25 L1=1.56 run=1 blk=0 avail=6910 (58.9%) swpO=0 conn=2 myRSS=2493 php=0 phpRSS=0 ap=18 tcp=22 topuser=- 2026-08-26 20:59:35 L1=1.39 run=2 blk=0 avail=6882 (58.7%) swpO=1 conn=4 myRSS=2493 php=2 phpRSS=109 ap=18 tcp=17 topuser=corpkicks 2026-08-26 20:59:35 L1=1.39 run=2 blk=0 avail=6806 (58.0%) swpO=1 conn=2 myRSS=2493 php=1 phpRSS=154 ap=18 tcp=18 topuser=corpkicks 2026-08-26 20:59:45 L1=1.65 run=2 blk=0 avail=6817 (58.1%) swpO=0 conn=4 myRSS=2493 php=2 phpRSS=156 ap=19 tcp=21 topuser=speedlin 2026-08-26 20:59:45 L1=1.65 run=2 blk=0 avail=6861 (58.5%) swpO=0 conn=2 myRSS=2493 php=1 phpRSS=88 ap=19 tcp=21 topuser=corpkicks 2026-08-26 20:59:55 L1=1.55 run=1 blk=0 avail=6914 (58.9%) swpO=1 conn=2 myRSS=2493 php=1 phpRSS=40 ap=19 tcp=18 topuser=evolution 2026-08-26 20:59:55 L1=1.55 run=3 blk=0 avail=6901 (58.8%) swpO=1 conn=2 myRSS=2493 php=1 phpRSS=56 ap=19 tcp=19 topuser=corpkicks 2026-08-26 21:00:05 L1=1.63 run=3 blk=0 avail=6857 (58.5%) swpO=0 conn=2 myRSS=2493 php=2 phpRSS=108 ap=19 tcp=23 topuser=evolution 2026-08-26 21:00:05 L1=1.63 run=3 blk=0 avail=6789 (57.9%) swpO=0 conn=3 myRSS=2493 php=2 phpRSS=182 ap=19 tcp=22 topuser=corpkicks 2026-08-26 21:00:15 L1=1.61 run=5 blk=0 avail=6788 (57.9%) swpO=0 conn=2 myRSS=2493 php=2 phpRSS=108 ap=18 tcp=21 topuser=evolution 2026-08-26 21:00:15 L1=1.61 run=1 blk=0 avail=6884 (58.7%) swpO=0 conn=3 myRSS=2493 php=2 phpRSS=95 ap=18 tcp=20 topuser=evolution 2026-08-26 21:00:25 L1=1.59 run=3 blk=0 avail=6796 (57.9%) swpO=0 conn=2 myRSS=2493 php=2 phpRSS=186 ap=18 tcp=23 topuser=corpkicks 2026-08-26 21:00:26 L1=1.59 run=1 blk=0 avail=6919 (59.0%) swpO=0 conn=3 myRSS=2493 php=0 phpRSS=0 ap=18 tcp=23 topuser=- 2026-08-26 21:00:35 L1=1.50 run=10 blk=0 avail=6481 (55.3%) swpO=0 conn=2 myRSS=2493 php=8 phpRSS=674 ap=19 tcp=51 topuser=tubesupplies 2026-08-26 21:00:36 L1=1.50 run=12 blk=0 avail=6122 (52.2%) swpO=0 conn=3 myRSS=2493 php=11 phpRSS=1169 ap=19 tcp=50 topuser=tubesupplies 2026-08-26 21:00:45 L1=1.93 run=1 blk=0 avail=6744 (57.5%) swpO=0 conn=2 myRSS=2493 php=0 phpRSS=0 ap=44 tcp=18 topuser=- 2026-08-26 21:00:46 L1=1.93 run=1 blk=0 avail=6745 (57.5%) swpO=0 conn=3 myRSS=2493 php=0 phpRSS=0 ap=44 tcp=66 topuser=- 2026-08-26 21:00:55 L1=6.43 run=33 blk=0 avail=4242 (36.2%) swpO=892 conn=23 myRSS=2473 php=27 phpRSS=3019 ap=74 tcp=75 topuser=tubesupplies 2026-08-26 21:00:56 L1=6.43 run=26 blk=0 avail=5318 (45.3%) swpO=892 conn=14 myRSS=2473 php=17 phpRSS=1659 ap=74 tcp=67 topuser=tubesupplies