INCIDENT 2026-08-26 23:50:27 trigger: php_procs=33 php_rss=3034MB mysql_conn=33 ================================================================== load: 4.06 1.86 1.46 40/732 3294229 ncpu:10 mem_avail: 5139MB/11729MB (43.8%) swap_used:2603MB swapout:75/s blocked(D):0 running:38 iowait:0.3% steal:0.0% php: 33 procs / 3034MB heaviest user: speedlin (31 procs, 2765MB) apache: 65 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB speedlin 30 2941 mysql 1 1941 nobody 64 999 root 239 697 netdata 8 254 evolution 7 184 customc 1 100 mailman 20 59 cpanellogin 1 55 kurri 4 49 dovenull 6 42 candyfabcom 2 28 wp-toolkit 6 20 zabbix 1 17 mailnull 3 16 dovecot 3 16 aaa 1 15 infinium 1 14 nscd 1 6 named 1 5 --- php workers by user --- USER PROCS RSS_MB speedlin 30 2975 evolution 1 176 customc 1 103 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5952 MB Active(file): 3339 MB Inactive(file): 1408 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 370 MB CommitLimit: 9960 MB Committed_AS: 12773 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2703186 root 22:39:11 756 /usr/bin/imunify-agent-proxy 3280299 root 00:27 3168 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 1982672 15.0 Ssl 1-20:19:11 /usr/sbin/mariadbd 1220 1 netdata 201868 2.5 Ssl 58-13:40:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1065018 2938778 root 181924 0.1 S 10:38:23 spamd child 3294196 3293951 speedlin 158348 66.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294198 3294013 speedlin 155768 61.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 143332 0.0 Ss 11-15:59:58 /usr/lib/systemd/systemd-journald 3294189 3293948 speedlin 140620 39.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294179 3294019 speedlin 122828 32.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294171 3293971 speedlin 118548 31.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294178 3212380 speedlin 118172 31.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294183 3293969 speedlin 117716 30.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294170 3293967 speedlin 116288 30.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294197 3280108 speedlin 114976 44.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294167 3293966 speedlin 114060 29.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294168 3294010 speedlin 114024 27.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294192 3294103 customc 113540 21.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3294177 3294008 speedlin 111616 27.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294194 3280391 speedlin 110328 42.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294188 3294075 speedlin 109504 27.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294164 3278308 speedlin 108376 27.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294187 3293938 speedlin 106960 25.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294175 3293950 speedlin 105036 26.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294174 3294023 speedlin 104848 24.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294165 3293970 speedlin 103264 24.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294176 3294082 speedlin 90560 21.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294182 3294014 speedlin 89236 21.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294172 3293972 speedlin 88828 20.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294185 3294044 speedlin 88640 20.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294166 3294020 speedlin 88508 19.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294180 3294080 speedlin 85800 18.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294195 3294076 speedlin 84960 26.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294173 3278595 speedlin 84952 18.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3294199 3292515 speedlin 81784 24.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2956399 2938778 root 72780 0.0 S 21:20:29 spamd child 2938778 1 root 69352 0.0 Ss 21:26:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3294238 3293939 madalice 60820 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2244622 1353308 cpanellogin 56996 0.0 S 05:07:51 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 39340 0.0 Sl 58-13:40:36 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 36176 0.1 Sl 58-13:40:32 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3212380 1276780 nobody 23824 0.0 S 22:51 /usr/sbin/httpd -k start 3262800 1276780 nobody 21428 0.0 S 05:43 /usr/sbin/httpd -k start 3276952 1276780 nobody 21116 0.0 S 05:01 /usr/sbin/httpd -k start 3229804 1276780 nobody 20864 0.0 S 16:32 /usr/sbin/httpd -k start 185104 2431 netdata 20384 2.1 Sl 14-03:16:55 /usr/libexec/netdata/plugins.d/apps.plugin 1 1469 1 root 19776 0.1 Ss 58-13:40:36 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3277361 1276780 nobody 19512 0.0 S 04:30 /usr/sbin/httpd -k start 3278595 1276780 nobody 19200 0.0 S 02:49 /usr/sbin/httpd -k start 3280108 1276780 nobody 18908 0.1 S 00:45 /usr/sbin/httpd -k start 3262465 1276780 nobody 18792 0.0 S 06:23 /usr/sbin/httpd -k start 3279806 1276780 nobody 18764 0.0 S 01:12 /usr/sbin/httpd -k start 3278308 1276780 nobody 18496 0.0 S 03:12 /usr/sbin/httpd -k start 3278594 1276780 nobody 17832 0.0 S 02:49 /usr/sbin/httpd -k start 3277886 1276780 nobody 17800 0.1 S 03:49 /usr/sbin/httpd -k start 3280107 1276780 nobody 17788 0.0 S 00:45 /usr/sbin/httpd -k start 1204 1 zabbix 17600 0.2 Ssl 58-13:40:37 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3279813 1276780 nobody 17500 0.0 S 01:11 /usr/sbin/httpd -k start 3280391 1276780 nobody 17076 0.0 S 00:26 /usr/sbin/httpd -k start 3293965 1276780 nobody 16932 0.0 S 00:15 /usr/sbin/httpd -k start 3278589 1276780 nobody 16904 0.1 S 02:50 /usr/sbin/httpd -k start 3294018 1276780 nobody 16880 0.0 S 00:14 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9009943 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9009910 | speedlin_wp | speedlin_wp | Query | 0 | Opening tables | SELECT MAX(attackLogTime) FROM w50Gr_wfhits | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/portal.evolutionerp.com.au-ssl_log 205 evolution/portal.evolutionerp.com.au 169 speedlin/speedlinefencing.com.au-ssl_log 110 tubesupplies/tubesupplies.com.au-ssl_log 99 evolution/evolutionerp.com.au-ssl_log 60 customc/customcentral.com.au-ssl_log 55 evolution/evolutionerp.com.au 47 otterfencing/otterfencing.com.au-ssl_log 37 evolution/my.evolutionerp.com.au-ssl_log 30 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 346 20.48.147.90 109 34.62.213.186 105 20.104.104.62 85 20.226.91.14 41 35.170.67.225 37 158.23.147.79 28 203.54.180.238 27 202.153.211.134 7 118.127.40.55 2 97.74.87.194 2 50.6.169.131 2 40.77.167.79 2 18.205.213.231 2 114.119.146.16 2 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 29 POST //wp-json/batch/v1 28 GET /heartbeat.php 16 POST /functions.php 13 GET /fetch 8 GET /app/ajax/selectFilter.php 5 POST /wp-cron.php 5 POST / 5 GET /new.php 5 GET / 4 GET /store/custom-brisbane-lions-shoes/ 4 GET /index.php 3 POST /wp-json/batch/v1 3 POST /index.php/wp-json/batch/v1 3 POST /index.php 3 GET /yawa.php 3 GET /wp-includes/ID3/index.php 3 GET /wp-css.php 3 GET /wp-content/themes/index.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /wp-content/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 28 GET /heartbeat.php 2 GET /wp-includes/ID3/index.php 1 GET /zxin.php 1 GET /zwso.php 1 GET /zwq13.php 1 GET /zolando.php 1 GET /ykewuql.php 1 GET /ykdyxlo.php 1 GET /xxx.php 1 GET /xwpg.php 1 GET /xty.php 1 GET /xleet -- last 10 requests -- 203.54.180.238 - - [26/Aug/2026:23:49:30 +1000] "GET /heartbeat.php?sentAt=1787752171&bytes=106,142,238,235&_=1787748997398 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [26/Aug/2026:23:49:34 +1000] "GET /heartbeat.php?sentAt=1787752174&bytes=106,142,238,238&_=1787631311470 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [26/Aug/2026:23:49:40 +1000] "GET /heartbeat.php?sentAt=1787752181&bytes=106,142,238,245&_=1787748997399 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [26/Aug/2026:23:49:44 +1000] "GET /heartbeat.php?sentAt=1787752184&bytes=106,142,238,248&_=1787631311471 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [26/Aug/2026:23:49:50 +1000] "GET /heartbeat.php?sentAt=1787752191&bytes=106,142,238,255&_=1787748997400 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [26/Aug/2026:23:49:54 +1000] "GET /heartbeat.php?sentAt=1787752194&bytes=106,142,239,2&_=1787631311472 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:00 +1000] "GET /heartbeat.php?sentAt=1787752201&bytes=106,142,239,9&_=1787748997401 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:04 +1000] "GET /heartbeat.php?sentAt=1787752204&bytes=106,142,239,12&_=1787631311473 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:15 +1000] "GET /heartbeat.php?sentAt=1787752211&bytes=106,142,239,19&_=1787748997402 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:15 +1000] "GET /heartbeat.php?sentAt=1787752214&bytes=106,142,239,22&_=1787631311474 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == evolution/portal.evolutionerp.com.au == -- top paths -- 1 GET /zxin.php 1 GET /zwso.php 1 GET /zwq13.php 1 GET /zolando.php 1 GET /ykewuql.php 1 GET /ykdyxlo.php 1 GET //xxx.php 1 GET /xwpg.php 1 GET /xleet 1 GET /ws45.php 1 GET /wp-ws68.php 1 GET /wp-wpbak.php -- last 10 requests -- 20.48.147.90 - - [26/Aug/2026:23:49:20 +1000] "GET /wp-includes/class.php HTTP/1.1" 301 304 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:21 +1000] "GET /cgi-bin/cgi-bin/about.php7 HTTP/1.1" 301 309 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:21 +1000] "GET /esp.php HTTP/1.1" 301 290 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:22 +1000] "GET /wp-includes/js/tinymce/plugins/about.php HTTP/1.1" 301 323 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:22 +1000] "GET /wp-content/themes/cay-van-phong/filemanager.php HTTP/1.1" 301 330 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:22 +1000] "GET /base.php HTTP/1.1" 301 291 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:23 +1000] "GET /sh3ll.php HTTP/1.1" 301 292 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:24 +1000] "GET /un.php HTTP/1.1" 301 289 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:25 +1000] "GET /02.php HTTP/1.1" 301 289 "-" "-" 20.48.147.90 - - [26/Aug/2026:23:49:25 +1000] "GET /2r.php HTTP/1.1" 301 289 "-" "-" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 17 GET /fetch 5 GET / 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /@fs/etc/passwd 1 POST /v1/graphql 1 POST /graphql/console 1 POST /graphql 1 POST /api/graphql -- last 10 requests -- 34.62.213.186 - - [26/Aug/2026:23:50:26 +1000] "GET /fetch?target=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Finfo HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_7) AppleWebKit/605.1.1 34.62.213.186 - - [26/Aug/2026:23:50:26 +1000] "GET /fetch?file=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Finfo HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, 34.62.213.186 - - [26/Aug/2026:23:50:25 +1000] "GET /debug/default/view?panel=config HTTP/1.1" 404 45250 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Discordbot/2.0; +https://discordapp.com" 34.62.213.186 - - [26/Aug/2026:23:50:25 +1000] "GET /read?url=file:///proc/1/environ HTTP/1.1" 404 45250 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.62.213.186 - - [26/Aug/2026:23:50:25 +1000] "GET /storage/logs/laravel.log HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.6583.68 Safari/537.36; c 34.62.213.186 - - [26/Aug/2026:23:50:25 +1000] "GET /.git/config HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.62.213.186 - - [26/Aug/2026:23:50:26 +1000] "GET /fetch?target=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F HTTP/1.1" 404 45250 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; TelegramBot/1 34.62.213.186 - - [26/Aug/2026:23:50:26 +1000] "GET /fetch?target=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Ma 34.62.213.186 - - [26/Aug/2026:23:50:25 +1000] "GET /@fs/proc/self/environ?import&raw?? HTTP/1.1" 404 45250 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai 34.62.213.186 - - [26/Aug/2026:23:50:25 +1000] "GET /_profiler/phpinfo HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.7377.139 Safari/537.36 Edg/128.0 --- last 30 samples (run-up to this incident) --- 2026-08-26 23:48:03 L1=1.36 run=1 blk=0 avail=7536 (64.3%) swpO=0 conn=2 myRSS=1945 php=0 phpRSS=0 ap=27 tcp=35 topuser=- 2026-08-26 23:48:07 L1=1.41 run=2 blk=0 avail=7416 (63.2%) swpO=0 conn=2 myRSS=1945 php=1 phpRSS=142 ap=27 tcp=34 topuser=evolution 2026-08-26 23:48:13 L1=1.46 run=2 blk=0 avail=7305 (62.3%) swpO=0 conn=2 myRSS=1945 php=2 phpRSS=301 ap=27 tcp=32 topuser=madalice 2026-08-26 23:48:17 L1=1.50 run=3 blk=0 avail=7521 (64.1%) swpO=0 conn=2 myRSS=1945 php=1 phpRSS=47 ap=27 tcp=34 topuser=customc 2026-08-26 23:48:23 L1=1.54 run=1 blk=0 avail=7536 (64.3%) swpO=0 conn=2 myRSS=1945 php=0 phpRSS=0 ap=27 tcp=31 topuser=- 2026-08-26 23:48:27 L1=1.58 run=3 blk=0 avail=7461 (63.6%) swpO=0 conn=2 myRSS=1945 php=1 phpRSS=89 ap=27 tcp=33 topuser=madalice 2026-08-26 23:48:33 L1=1.45 run=3 blk=0 avail=7453 (63.5%) swpO=0 conn=2 myRSS=1945 php=2 phpRSS=119 ap=27 tcp=37 topuser=evolution 2026-08-26 23:48:37 L1=1.42 run=3 blk=0 avail=7406 (63.1%) swpO=0 conn=2 myRSS=1945 php=1 phpRSS=119 ap=27 tcp=30 topuser=evolution 2026-08-26 23:48:43 L1=1.46 run=3 blk=0 avail=7516 (64.1%) swpO=0 conn=2 myRSS=1945 php=1 phpRSS=35 ap=27 tcp=31 topuser=evolution 2026-08-26 23:48:47 L1=1.35 run=1 blk=0 avail=7540 (64.3%) swpO=0 conn=2 myRSS=1945 php=0 phpRSS=0 ap=26 tcp=34 topuser=- 2026-08-26 23:48:53 L1=1.24 run=1 blk=0 avail=7538 (64.3%) swpO=0 conn=1 myRSS=1945 php=0 phpRSS=0 ap=26 tcp=31 topuser=- 2026-08-26 23:48:57 L1=1.22 run=3 blk=0 avail=7411 (63.2%) swpO=0 conn=2 myRSS=1945 php=1 phpRSS=157 ap=26 tcp=31 topuser=alison 2026-08-26 23:49:03 L1=1.12 run=1 blk=0 avail=7531 (64.2%) swpO=0 conn=1 myRSS=1945 php=0 phpRSS=0 ap=26 tcp=33 topuser=- 2026-08-26 23:49:07 L1=1.43 run=1 blk=0 avail=7533 (64.2%) swpO=0 conn=2 myRSS=1947 php=0 phpRSS=0 ap=26 tcp=33 topuser=- 2026-08-26 23:49:13 L1=1.40 run=3 blk=0 avail=7525 (64.2%) swpO=0 conn=1 myRSS=1947 php=1 phpRSS=50 ap=26 tcp=32 topuser=customc 2026-08-26 23:49:17 L1=1.37 run=3 blk=0 avail=7268 (62.0%) swpO=0 conn=2 myRSS=1947 php=2 phpRSS=304 ap=29 tcp=39 topuser=evolution 2026-08-26 23:49:23 L1=1.26 run=2 blk=0 avail=7487 (63.8%) swpO=0 conn=1 myRSS=1947 php=1 phpRSS=69 ap=28 tcp=30 topuser=customc 2026-08-26 23:49:27 L1=1.16 run=3 blk=0 avail=7219 (61.6%) swpO=0 conn=4 myRSS=1947 php=3 phpRSS=432 ap=24 tcp=34 topuser=customc 2026-08-26 23:49:33 L1=1.38 run=1 blk=0 avail=7561 (64.5%) swpO=0 conn=1 myRSS=1947 php=0 phpRSS=0 ap=24 tcp=32 topuser=- 2026-08-26 23:49:37 L1=1.35 run=3 blk=0 avail=7202 (61.4%) swpO=0 conn=4 myRSS=1947 php=4 phpRSS=467 ap=24 tcp=31 topuser=evolution 2026-08-26 23:49:43 L1=1.32 run=4 blk=0 avail=7184 (61.3%) swpO=0 conn=1 myRSS=1947 php=4 phpRSS=496 ap=26 tcp=40 topuser=evolution 2026-08-26 23:49:47 L1=1.30 run=3 blk=0 avail=7251 (61.8%) swpO=0 conn=4 myRSS=1947 php=2 phpRSS=369 ap=26 tcp=29 topuser=madalice 2026-08-26 23:49:53 L1=1.35 run=1 blk=0 avail=7609 (64.9%) swpO=0 conn=1 myRSS=1947 php=0 phpRSS=0 ap=20 tcp=25 topuser=- 2026-08-26 23:49:57 L1=1.49 run=4 blk=0 avail=7334 (62.5%) swpO=0 conn=4 myRSS=1947 php=2 phpRSS=325 ap=18 tcp=30 topuser=evolution 2026-08-26 23:50:03 L1=1.45 run=3 blk=0 avail=7466 (63.7%) swpO=1 conn=1 myRSS=1947 php=1 phpRSS=127 ap=21 tcp=33 topuser=customc 2026-08-26 23:50:07 L1=1.41 run=4 blk=0 avail=7381 (62.9%) swpO=1 conn=4 myRSS=1947 php=1 phpRSS=142 ap=21 tcp=25 topuser=customc 2026-08-26 23:50:13 L1=1.38 run=12 blk=0 avail=6705 (57.2%) swpO=0 conn=1 myRSS=1947 php=13 phpRSS=1188 ap=36 tcp=68 topuser=speedlin 2026-08-26 23:50:17 L1=2.31 run=7 blk=0 avail=6791 (57.9%) swpO=0 conn=4 myRSS=1947 php=5 phpRSS=723 ap=52 tcp=85 topuser=speedlin 2026-08-26 23:50:23 L1=3.89 run=7 blk=0 avail=7034 (60.0%) swpO=34 conn=1 myRSS=1946 php=6 phpRSS=433 ap=65 tcp=38 topuser=speedlin 2026-08-26 23:50:27 L1=4.06 run=38 blk=0 avail=5139 (43.8%) swpO=75 conn=33 myRSS=1944 php=33 phpRSS=3034 ap=65 tcp=67 topuser=speedlin