INCIDENT 2026-08-26 23:51:32 trigger: swapout=2626/s php_procs=68 php_rss=5478MB mysql_conn=66 ================================================================== load: 19.43 6.49 3.07 73/807 3295464 ncpu:10 mem_avail: 3460MB/11729MB (29.5%) swap_used:2753MB swapout:2626/s blocked(D):0 running:72 iowait:0.3% steal:0.0% php: 68 procs / 5478MB heaviest user: speedlin (64 procs, 5041MB) apache: 109 procs tcp_estab: 88 --- RSS by user (all processes) --- USER PROCS RSS_MB speedlin 62 5187 mysql 1 1889 nobody 108 1677 root 236 671 netdata 8 253 madalice 2 206 customc 1 142 evolution 7 112 mailman 20 59 lowrange 4 57 cpanellogin 1 54 dovenull 6 42 kurri 2 20 wp-toolkit 6 19 mailnull 3 16 dovecot 3 16 aaa 1 15 zabbix 1 14 infinium 1 14 nscd 1 6 --- php workers by user --- USER PROCS RSS_MB speedlin 62 5210 madalice 2 211 customc 1 147 evolution 1 105 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5218 MB Active(file): 2017 MB Inactive(file): 1113 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 328 MB CommitLimit: 9960 MB Committed_AS: 19077 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2703186 root 22:40:16 640 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 1932388 15.0 Ssl 1-20:20:16 /usr/sbin/mariadbd 1220 1 netdata 201936 2.5 Ssl 58-13:41:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1065018 2938778 root 181920 0.1 S 10:39:28 spamd child 3295263 3294081 speedlin 158576 16.3 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295271 3294021 customc 155228 12.3 R 00:12 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3295261 3294014 speedlin 152352 15.7 S 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295250 3294644 speedlin 151996 17.5 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295226 3295145 speedlin 151932 17.8 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295234 3294996 speedlin 149080 17.2 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295265 3295144 speedlin 145952 14.9 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 144136 0.0 Ss 11-16:01:03 /usr/lib/systemd/systemd-journald 3295258 3295047 speedlin 144076 15.0 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295243 3294995 speedlin 141404 13.6 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295262 3294016 speedlin 140592 12.8 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295235 3294102 speedlin 139660 16.0 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295251 3293965 speedlin 137864 13.3 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295307 3295050 madalice 133808 14.0 R 00:11 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295387 3294821 speedlin 133364 28.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295255 3262465 speedlin 132672 14.9 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295268 3294023 speedlin 130456 12.7 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295231 3294999 speedlin 125040 14.4 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295389 3293972 evolution 112836 13.2 R 00:04 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3295393 3278308 speedlin 111600 36.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295241 3294639 speedlin 110592 18.3 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295384 3294979 speedlin 101460 17.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295385 3295098 speedlin 97036 28.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295377 3294161 madalice 93752 21.1 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295417 3295073 speedlin 89260 26.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295397 3295326 speedlin 86552 21.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295412 3294980 speedlin 86344 18.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295433 3293969 speedlin 86292 37.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295413 3295138 speedlin 76728 28.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295416 3295364 speedlin 76008 14.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295405 3295324 speedlin 75400 13.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295408 3295311 speedlin 75364 14.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295401 3294964 speedlin 71228 23.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295419 3295116 speedlin 70356 24.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295400 3294993 speedlin 69948 23.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938778 1 root 69308 0.0 Ss 21:28:04 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3295428 3295361 speedlin 67716 15.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2956399 2938778 root 66440 0.0 S 21:21:34 spamd child 3295410 3295122 speedlin 66344 14.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295411 3294642 speedlin 65888 14.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295431 3295365 speedlin 65704 22.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295425 3294643 speedlin 65660 14.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295434 3295068 speedlin 65356 26.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295399 3295070 speedlin 65112 10.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295386 3294994 speedlin 64860 15.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295420 3293966 speedlin 64832 14.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295403 3281110 speedlin 64480 10.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295427 3295362 speedlin 64408 9.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295409 3294075 speedlin 63868 9.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295426 3295363 speedlin 63456 9.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295424 3295320 speedlin 63232 13.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295423 3294638 speedlin 61528 8.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295392 3295072 speedlin 61416 8.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295396 3295123 speedlin 60612 18.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295415 3295140 speedlin 60148 10.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295422 3295067 speedlin 60044 7.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3295406 3295120 speedlin 59136 14.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- 3295486 D - /sbin/exim -bpc --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9010338 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9010232 | speedlin_wp | speedlin_wp | Query | 0 | Sending data | SELECT w50Gr_posts.* FROM w50Gr_posts WHERE ID IN (4,6,8,423,392,411,409,413,284,239,529) | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min speedlin/speedlinefencing.com.au-ssl_log 402 evolution/portal.evolutionerp.com.au-ssl_log 84 customc/customcentral.com.au-ssl_log 67 tubesupplies/tubesupplies.com.au-ssl_log 61 evolution/portal.evolutionerp.com.au 47 evolution/evolutionerp.com.au-ssl_log 28 evolution/my.evolutionerp.com.au-ssl_log 27 evolution/evolutionerp.com.au 16 madalice/madalice.com.au-ssl_log 12 aaa/aaadownunder.com.au-ssl_log 9 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 378 34.62.213.186 103 20.48.147.90 61 20.226.91.14 58 35.170.67.225 44 20.104.104.62 28 203.54.180.238 27 118.127.40.55 24 202.153.211.134 3 4.204.200.136 2 91.92.243.234 2 40.77.167.79 2 185.194.184.84 2 114.119.130.40 1 95.130.227.13 1 92.205.239.73 --- top request paths across all vhosts (last 3 min) --- 46 POST //wp-json/batch/v1 28 GET /heartbeat.php 27 POST / 27 GET /fetch 13 POST /functions.php 8 GET /proxy 8 GET /app/ajax/selectFilter.php 7 GET /store/custom-brisbane-lions-shoes/ 7 GET / 5 POST /wp-cron.php 4 POST /wp-login.php 4 GET /index.php 3 POST /wp-json/batch/v1 3 POST /index.php/wp-json/batch/v1 3 POST /index.php 3 GET /wp-includes/ID3/index.php 3 GET /wp-css.php 3 GET /wp-content/themes/index.php 3 GET /wp5.php 3 GET /we.php --- busiest 3 vhosts: top paths + last 10 requests --- == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 27 GET /fetch 20 POST / 8 GET /proxy 6 GET / 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 2 GET /webhook 2 GET /screenshot 2 GET /redirect 2 GET /preview 2 GET /pms -- last 10 requests -- 91.134.139.15 - - [26/Aug/2026:23:51:22 +1000] "POST /wp-login.php HTTP/1.1" 503 18956 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chro 114.119.149.89 - - [26/Aug/2026:23:51:20 +1000] "GET /robots.txt HTTP/1.1" 301 1 "https://www.speedlinefencing.com.au/robots.txt" "Mozilla/5.0 (compatible;PetalBot;+https://webmaster.petalsearch.com/site/petalbot)" 34.62.213.186 - - [26/Aug/2026:23:51:20 +1000] "GET /privatekey.key HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Windows NT 10.0; rv:149.12) Gecko/20100101 Firefox/149.12; compatible; meta-externalagent/1.1; +https://developers 34.62.213.186 - - [26/Aug/2026:23:51:21 +1000] "GET /values.yaml HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://pe 34.62.213.186 - - [26/Aug/2026:23:51:20 +1000] "GET /bootstrap.properties HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:143.10) Gecko/20100101 Firefox/143.10; compatible; Bytespider; +https:// 34.62.213.186 - - [26/Aug/2026:23:51:21 +1000] "GET /key.pem HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)" 34.62.213.186 - - [26/Aug/2026:23:51:20 +1000] "GET /.kube/config HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthro 34.62.213.186 - - [26/Aug/2026:23:51:20 +1000] "GET /nginx_status HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.8569.164 Mobile Safari 34.62.213.186 - - [26/Aug/2026:23:51:20 +1000] "GET /wp-json HTTP/1.1" 200 127622 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; WhatsApp/10.0.2.1" 34.62.213.186 - - [26/Aug/2026:23:51:20 +1000] "GET /api/account HTTP/1.1" 404 45250 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot)" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 28 GET /heartbeat.php 2 GET /wp-includes/ID3/index.php 1 GET /zxin.php 1 GET /ykewuql.php 1 GET /xty.php 1 GET /wp-site.php 1 GET /wp-mail.php/wp-includes/ID3/rnEPv9.php 1 GET /wp-includes/text.php 1 GET /wp-includes/js/tinymce/plugins/about.php 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/class.php 1 GET /wp-feed.php -- last 10 requests -- 203.54.180.238 - - [26/Aug/2026:23:50:30 +1000] "GET /heartbeat.php?sentAt=1787752231&bytes=106,142,239,39&_=1787748997404 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:34 +1000] "GET /heartbeat.php?sentAt=1787752234&bytes=106,142,239,42&_=1787631311476 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:40 +1000] "GET /heartbeat.php?sentAt=1787752241&bytes=106,142,239,49&_=1787748997405 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:44 +1000] "GET /heartbeat.php?sentAt=1787752244&bytes=106,142,239,52&_=1787631311477 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:50 +1000] "GET /heartbeat.php?sentAt=1787752251&bytes=106,142,239,59&_=1787748997406 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:50:54 +1000] "GET /heartbeat.php?sentAt=1787752254&bytes=106,142,239,62&_=1787631311478 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:51:02 +1000] "GET /heartbeat.php?sentAt=1787752261&bytes=106,142,239,69&_=1787748997407 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:51:05 +1000] "GET /heartbeat.php?sentAt=1787752264&bytes=106,142,239,72&_=1787631311479 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:51:15 +1000] "GET /heartbeat.php?sentAt=1787752271&bytes=106,142,239,79&_=1787748997408 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [26/Aug/2026:23:51:16 +1000] "GET /heartbeat.php?sentAt=1787752274&bytes=106,142,239,82&_=1787631311480 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == customc/customcentral.com.au-ssl_log == -- top paths -- 46 POST //wp-json/batch/v1 5 POST / 3 POST /wp-json/batch/v1 3 POST /index.php/wp-json/batch/v1 3 POST /index.php 2 POST /wp-cron.php 1 GET /wp-json/zakra/v1/v1/users 1 GET /wp-json/zakra/v1/members 1 GET /wp-json/wp/v2/users 1 GET /wp-json/wc-admin/features/members 1 GET /wp-json/batch/v1/users -- last 10 requests -- 35.170.67.225 - - [26/Aug/2026:23:50:32 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:34 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:38 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:41 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:43 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:44 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:47 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:50 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:52 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.170.67.225 - - [26/Aug/2026:23:50:54 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-26 23:49:03 L1=1.12 run=1 blk=0 avail=7531 (64.2%) swpO=0 conn=1 myRSS=1945 php=0 phpRSS=0 ap=26 tcp=33 topuser=- 2026-08-26 23:49:07 L1=1.43 run=1 blk=0 avail=7533 (64.2%) swpO=0 conn=2 myRSS=1947 php=0 phpRSS=0 ap=26 tcp=33 topuser=- 2026-08-26 23:49:13 L1=1.40 run=3 blk=0 avail=7525 (64.2%) swpO=0 conn=1 myRSS=1947 php=1 phpRSS=50 ap=26 tcp=32 topuser=customc 2026-08-26 23:49:17 L1=1.37 run=3 blk=0 avail=7268 (62.0%) swpO=0 conn=2 myRSS=1947 php=2 phpRSS=304 ap=29 tcp=39 topuser=evolution 2026-08-26 23:49:23 L1=1.26 run=2 blk=0 avail=7487 (63.8%) swpO=0 conn=1 myRSS=1947 php=1 phpRSS=69 ap=28 tcp=30 topuser=customc 2026-08-26 23:49:27 L1=1.16 run=3 blk=0 avail=7219 (61.6%) swpO=0 conn=4 myRSS=1947 php=3 phpRSS=432 ap=24 tcp=34 topuser=customc 2026-08-26 23:49:33 L1=1.38 run=1 blk=0 avail=7561 (64.5%) swpO=0 conn=1 myRSS=1947 php=0 phpRSS=0 ap=24 tcp=32 topuser=- 2026-08-26 23:49:37 L1=1.35 run=3 blk=0 avail=7202 (61.4%) swpO=0 conn=4 myRSS=1947 php=4 phpRSS=467 ap=24 tcp=31 topuser=evolution 2026-08-26 23:49:43 L1=1.32 run=4 blk=0 avail=7184 (61.3%) swpO=0 conn=1 myRSS=1947 php=4 phpRSS=496 ap=26 tcp=40 topuser=evolution 2026-08-26 23:49:47 L1=1.30 run=3 blk=0 avail=7251 (61.8%) swpO=0 conn=4 myRSS=1947 php=2 phpRSS=369 ap=26 tcp=29 topuser=madalice 2026-08-26 23:49:53 L1=1.35 run=1 blk=0 avail=7609 (64.9%) swpO=0 conn=1 myRSS=1947 php=0 phpRSS=0 ap=20 tcp=25 topuser=- 2026-08-26 23:49:57 L1=1.49 run=4 blk=0 avail=7334 (62.5%) swpO=0 conn=4 myRSS=1947 php=2 phpRSS=325 ap=18 tcp=30 topuser=evolution 2026-08-26 23:50:03 L1=1.45 run=3 blk=0 avail=7466 (63.7%) swpO=1 conn=1 myRSS=1947 php=1 phpRSS=127 ap=21 tcp=33 topuser=customc 2026-08-26 23:50:07 L1=1.41 run=4 blk=0 avail=7381 (62.9%) swpO=1 conn=4 myRSS=1947 php=1 phpRSS=142 ap=21 tcp=25 topuser=customc 2026-08-26 23:50:13 L1=1.38 run=12 blk=0 avail=6705 (57.2%) swpO=0 conn=1 myRSS=1947 php=13 phpRSS=1188 ap=36 tcp=68 topuser=speedlin 2026-08-26 23:50:17 L1=2.31 run=7 blk=0 avail=6791 (57.9%) swpO=0 conn=4 myRSS=1947 php=5 phpRSS=723 ap=52 tcp=85 topuser=speedlin 2026-08-26 23:50:23 L1=3.89 run=7 blk=0 avail=7034 (60.0%) swpO=34 conn=1 myRSS=1946 php=6 phpRSS=433 ap=65 tcp=38 topuser=speedlin 2026-08-26 23:50:27 L1=4.06 run=38 blk=0 avail=5139 (43.8%) swpO=75 conn=33 myRSS=1944 php=33 phpRSS=3034 ap=65 tcp=67 topuser=speedlin 2026-08-26 23:50:33 L1=6.45 run=3 blk=0 avail=7057 (60.2%) swpO=544 conn=1 myRSS=1931 php=2 phpRSS=331 ap=60 tcp=34 topuser=madalice 2026-08-26 23:50:40 L1=8.00 run=19 blk=0 avail=5572 (47.5%) swpO=446 conn=12 myRSS=1929 php=15 phpRSS=2046 ap=73 tcp=58 topuser=speedlin 2026-08-26 23:50:44 L1=8.00 run=2 blk=0 avail=7158 (61.0%) swpO=69 conn=1 myRSS=1929 php=1 phpRSS=150 ap=70 tcp=34 topuser=customc 2026-08-26 23:50:51 L1=9.24 run=15 blk=0 avail=6421 (54.7%) swpO=0 conn=12 myRSS=1929 php=12 phpRSS=1228 ap=65 tcp=44 topuser=speedlin 2026-08-26 23:50:54 L1=9.24 run=45 blk=0 avail=6167 (52.6%) swpO=0 conn=24 myRSS=1929 php=22 phpRSS=1871 ap=63 tcp=58 topuser=speedlin 2026-08-26 23:51:01 L1=10.13 run=39 blk=0 avail=5887 (50.2%) swpO=0 conn=35 myRSS=1929 php=35 phpRSS=2510 ap=58 tcp=79 topuser=speedlin 2026-08-26 23:51:04 L1=10.13 run=37 blk=0 avail=4435 (37.8%) swpO=542 conn=36 myRSS=1914 php=36 phpRSS=3995 ap=72 tcp=74 topuser=speedlin 2026-08-26 23:51:11 L1=12.96 run=2 blk=0 avail=7016 (59.8%) swpO=567 conn=35 myRSS=1913 php=1 phpRSS=213 ap=85 tcp=143 topuser=corpkicks 2026-08-26 23:51:15 L1=13.69 run=23 blk=0 avail=6200 (52.9%) swpO=23 conn=21 myRSS=1913 php=20 phpRSS=1568 ap=100 tcp=127 topuser=speedlin 2026-08-26 23:51:21 L1=14.43 run=54 blk=0 avail=5349 (45.6%) swpO=0 conn=43 myRSS=1913 php=52 phpRSS=3275 ap=97 tcp=97 topuser=speedlin 2026-08-26 23:51:25 L1=18.16 run=56 blk=0 avail=3876 (33.0%) swpO=1218 conn=49 myRSS=1904 php=48 phpRSS=4617 ap=104 tcp=120 topuser=speedlin 2026-08-26 23:51:32 L1=19.43 run=72 blk=0 avail=3460 (29.5%) swpO=2626 conn=66 myRSS=1891 php=68 phpRSS=5478 ap=109 tcp=88 topuser=speedlin