INCIDENT 2026-08-27 17:15:53 trigger: php_rss=1693MB mysql_conn=21 ================================================================== load: 7.25 2.72 1.87 15/706 2802568 ncpu:10 mem_avail: 5598MB/11729MB (47.7%) swap_used:2464MB swapout:0/s blocked(D):0 running:19 iowait:0.0% steal:0.0% php: 21 procs / 1693MB heaviest user: vinesit (20 procs, 1601MB) apache: 53 procs tcp_estab: 72 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2725 vinesit 20 1698 nobody 52 856 root 238 629 netdata 8 256 tubesupplies 1 99 cpanellogin 1 81 alison 5 70 mailman 20 47 dovenull 6 44 mailnull 4 33 wp-toolkit 6 19 dovecot 3 17 aaa 1 14 zabbix 1 13 kurri 1 7 nscd 1 5 named 1 4 cpanelconnecttrack 1 3 evolution 4 2 --- php workers by user --- USER PROCS RSS_MB vinesit 20 1698 tubesupplies 1 100 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5362 MB Active(file): 3941 MB Inactive(file): 927 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 355 MB CommitLimit: 9960 MB Committed_AS: 10572 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2737397 root 15:52 3004 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3565593 root 16:04:37 2708 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2790984 17.0 Ssl 2-13:44:37 /usr/sbin/mariadbd 1220 1 netdata 203680 2.5 Ssl 59-07:06:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1910875 3797563 root 168456 0.2 S 04:02:01 spamd child 3846467 3797563 root 126496 0.0 S 14:40:19 spamd child 2802495 2792679 tubesupplies 111136 105 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802492 2792678 vinesit 95184 31.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802491 2793931 vinesit 95140 31.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802493 2785792 vinesit 95020 33.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802499 2791095 vinesit 94600 65.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802489 2792671 vinesit 94560 30.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802483 2791091 vinesit 94532 32.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802487 2787609 vinesit 94512 34.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802488 2793957 vinesit 94452 35.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802502 2785790 vinesit 93420 60.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802504 2787833 vinesit 93372 65.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802485 2793935 vinesit 93140 31.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802494 2788012 vinesit 93076 31.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802484 2793941 vinesit 92672 32.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802505 2785788 vinesit 92624 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802507 2793948 vinesit 88936 52.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1103418 1353308 cpanellogin 82948 0.0 S 07:39:30 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 3797563 1 root 79528 0.0 Ss 14:52:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2802509 2793943 vinesit 71772 31.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802511 2802305 vinesit 68844 29.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802524 2793958 vinesit 60644 17.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2802580 2791090 vinesit 46288 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 44032 0.0 Sl 59-07:06:02 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2575382 1 root 34664 0.0 Ss 12-09:25:24 /usr/lib/systemd/systemd-journald 4922 2431 netdata 32536 0.1 Sl 59-07:05:58 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 23860 0.0 Ss 36-14:34:33 cpsrvd (SSL) - waiting for connections 2787100 1276780 nobody 22304 0.0 S 02:37 /usr/sbin/httpd -k start 1469 1 root 21936 0.1 Ss 59-07:06:02 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2785790 1276780 nobody 21380 0.0 S 04:06 /usr/sbin/httpd -k start 2785792 1276780 nobody 20584 0.0 S 04:06 /usr/sbin/httpd -k start 2785788 1276780 nobody 20376 0.0 S 04:06 /usr/sbin/httpd -k start 2792672 1276780 nobody 19848 0.1 S 00:48 /usr/sbin/httpd -k start 2791090 1276780 nobody 19484 0.1 S 00:49 /usr/sbin/httpd -k start 2793943 1276780 nobody 19428 0.0 S 00:47 /usr/sbin/httpd -k start 185104 2431 netdata 19412 2.1 Sl 14-20:42:21 /usr/libexec/netdata/plugins.d/apps.plugin 1 2792682 1276780 nobody 19372 0.1 S 00:48 /usr/sbin/httpd -k start 2789538 1276780 nobody 19248 0.0 S 00:50 /usr/sbin/httpd -k start 2791096 1276780 nobody 19084 0.0 S 00:49 /usr/sbin/httpd -k start 2792671 1276780 nobody 19036 0.0 S 00:48 /usr/sbin/httpd -k start 2793948 1276780 nobody 19004 0.0 S 00:47 /usr/sbin/httpd -k start 2792679 1276780 nobody 18872 0.0 S 00:48 /usr/sbin/httpd -k start 2787824 1276780 nobody 18504 0.0 S 01:02 /usr/sbin/httpd -k start 2787832 1276780 nobody 18396 0.0 S 01:01 /usr/sbin/httpd -k start 2787609 1276780 nobody 18352 0.0 S 01:39 /usr/sbin/httpd -k start 2793952 1276780 nobody 18220 0.0 S 00:47 /usr/sbin/httpd -k start 2792676 1276780 nobody 18216 0.0 S 00:48 /usr/sbin/httpd -k start 2788350 1276780 nobody 18092 0.0 S 00:51 /usr/sbin/httpd -k start 2788012 1276780 nobody 18040 0.0 S 00:52 /usr/sbin/httpd -k start 2792684 1276780 nobody 17976 0.0 S 00:48 /usr/sbin/httpd -k start 2792680 1276780 nobody 17964 0.0 S 00:48 /usr/sbin/httpd -k start 2793932 1276780 nobody 17916 0.0 S 00:47 /usr/sbin/httpd -k start 2792677 1276780 nobody 17908 0.0 S 00:48 /usr/sbin/httpd -k start 2792673 1276780 nobody 17828 0.0 S 00:48 /usr/sbin/httpd -k start 2793928 1276780 nobody 17756 0.0 S 00:47 /usr/sbin/httpd -k start 2787833 1276780 nobody 17532 0.0 S 01:01 /usr/sbin/httpd -k start 2791092 1276780 nobody 17232 0.0 S 00:49 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 13863875 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 476 infinium/infinium.net.au-ssl_log 96 evolution/my.evolutionerp.com.au-ssl_log 76 madalice/madalice.com.au-ssl_log 31 evolution/portal.evolutionerp.com.au-ssl_log 30 aaa/aaadownunder.com.au-ssl_log 29 evolution/evolutionerp.com.au-ssl_log 17 customkidscom/customkids.com.au-ssl_log 6 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 427 34.90.68.211 90 52.139.37.240 62 203.54.180.238 51 118.127.40.55 16 185.212.171.157 15 130.195.241.7 14 120.21.95.194 10 103.104.164.114 8 195.178.110.28 6 20.220.10.235 6 147.161.213.78 6 101.182.108.127 5 182.239.240.254 4 66.249.73.160 4 209.38.145.187 --- top request paths across all vhosts (last 3 min) --- 54 POST /functions.php 54 GET /fetch 47 POST / 30 GET /heartbeat.php 16 GET /proxy 12 GET / 11 GET /wp-login.php 10 POST /app/ajax/selectFilter.php 8 POST /wp-login.php 8 GET /.env 7 POST /wp-cron.php 6 POST /quoteditsave.php 6 GET /@fs/proc/self/environ 6 GET /autodiscover/autodiscover.xml 5 GET /xmlrpc.php 5 GET /store/gift-card-2/ 5 GET /store/gift-card/ 5 GET /read 4 POST /itemModify.php 4 GET /webhook --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 54 GET /fetch 44 POST / 16 GET /proxy 6 GET /@fs/proc/self/environ 5 GET /read 4 GET /webhook 4 GET /screenshot 4 GET /redirect 4 GET /preview 4 GET /image 4 GET /@fs/proc/1/environ 4 GET /@fs/etc/passwd -- last 10 requests -- 34.90.68.211 - - [27/Aug/2026:17:15:52 +1000] "GET /api/v1/aws/credentials HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; GPTBot/1.4; +https://openai.com/gptbot)" 118.127.40.55 - - [27/Aug/2026:17:15:53 +1000] "POST /?wordfence_syncAttackData=1787814953.061 HTTP/1.1" 200 6856 "-" "WordPress/7.1; https://www.vinesit.com.au" 118.127.40.55 - - [27/Aug/2026:17:15:53 +1000] "POST /?wordfence_syncAttackData=1787814953.111 HTTP/1.1" 200 6856 "-" "WordPress/7.1; https://www.vinesit.com.au" 118.127.40.55 - - [27/Aug/2026:17:15:53 +1000] "POST /?wordfence_syncAttackData=1787814953.0967 HTTP/1.1" 200 6856 "-" "WordPress/7.1; https://www.vinesit.com.au" 34.90.68.211 - - [27/Aug/2026:17:15:52 +1000] "GET /aws/iam/temporary-credentials HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/sup 34.90.68.211 - - [27/Aug/2026:17:15:52 +1000] "GET /aws/metadata/iam/security-credentials HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/p 118.127.40.55 - - [27/Aug/2026:17:15:53 +1000] "POST /?wordfence_syncAttackData=1787814953.2324 HTTP/1.1" 200 6856 "-" "WordPress/7.1; https://www.vinesit.com.au" 34.90.68.211 - - [27/Aug/2026:17:15:52 +1000] "GET /.env.php.bak HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; TelegramBot/1.0)" 118.127.40.55 - - [27/Aug/2026:17:15:53 +1000] "POST /?wordfence_syncAttackData=1787814953.1186 HTTP/1.1" 200 6856 "-" "WordPress/7.1; https://www.vinesit.com.au" 34.90.68.211 - - [27/Aug/2026:17:15:52 +1000] "GET /api/aws/credentials HTTP/1.1" 301 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:149.15) Gecko/20100101 Firefox/149.15; compatible; facebookexternalhit/1.1; +ht == infinium/infinium.net.au-ssl_log == -- top paths -- 2 POST /wp-login.php 2 POST /wp-cron.php 2 GET /wp-login.php 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ww2.php 1 GET /ws80.php 1 GET /ws49.php 1 GET /wp/wp-admin/includes/ -- last 10 requests -- 52.139.37.240 - - [27/Aug/2026:17:15:37 +1000] "GET /wp/wp-admin/includes/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:38 +1000] "GET /ws80.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:38 +1000] "GET /ww2.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:38 +1000] "GET /7logs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:38 +1000] "GET /ac.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:38 +1000] "GET /assets/images/doc.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:39 +1000] "GET /ctex1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:39 +1000] "GET /defaults.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:39 +1000] "GET /domains.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:17:15:39 +1000] "GET /dropdown.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 54 POST /functions.php 10 POST /app/ajax/selectFilter.php 6 POST /quoteditsave.php 4 POST /itemModify.php 2 GET /index.php -- last 10 requests -- 103.104.164.114 - - [27/Aug/2026:17:15:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4642&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 103.104.164.114 - - [27/Aug/2026:17:15:06 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 120.21.95.194 - - [27/Aug/2026:17:15:11 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G 120.21.95.194 - - [27/Aug/2026:17:15:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=14153" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 120.21.95.194 - - [27/Aug/2026:17:15:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page%3Djobedit%26id%3D29537" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 120.21.95.194 - - [27/Aug/2026:17:15:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78513" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 120.21.95.194 - - [27/Aug/2026:17:15:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29537&tab=filestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 147.161.213.78 - - [27/Aug/2026:17:15:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=fsinstruction&id=19242" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 147.161.213.78 - - [27/Aug/2026:17:15:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=fsinstruction&id=19245" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 101.182.108.127 - - [27/Aug/2026:17:15:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C --- last 30 samples (run-up to this incident) --- 2026-08-27 17:13:32 L1=0.96 run=5 blk=0 avail=6487 (55.3%) swpO=0 conn=2 myRSS=2729 php=2 phpRSS=341 ap=21 tcp=33 topuser=madalice 2026-08-27 17:13:32 L1=0.96 run=4 blk=0 avail=6475 (55.2%) swpO=0 conn=1 myRSS=2729 php=2 phpRSS=350 ap=21 tcp=33 topuser=madalice 2026-08-27 17:13:42 L1=0.89 run=2 blk=0 avail=6831 (58.2%) swpO=0 conn=2 myRSS=2729 php=0 phpRSS=0 ap=22 tcp=26 topuser=- 2026-08-27 17:13:42 L1=0.89 run=5 blk=0 avail=6827 (58.2%) swpO=0 conn=1 myRSS=2729 php=1 phpRSS=35 ap=22 tcp=26 topuser=evolution 2026-08-27 17:13:52 L1=1.06 run=2 blk=0 avail=6833 (58.3%) swpO=0 conn=2 myRSS=2729 php=1 phpRSS=65 ap=17 tcp=30 topuser=evolution 2026-08-27 17:13:52 L1=1.06 run=3 blk=0 avail=6832 (58.2%) swpO=0 conn=1 myRSS=2729 php=1 phpRSS=65 ap=17 tcp=30 topuser=evolution 2026-08-27 17:14:02 L1=0.98 run=5 blk=0 avail=6694 (57.1%) swpO=0 conn=3 myRSS=2729 php=3 phpRSS=258 ap=17 tcp=30 topuser=tubesupplies 2026-08-27 17:14:02 L1=0.98 run=4 blk=0 avail=6686 (57.0%) swpO=0 conn=1 myRSS=2729 php=3 phpRSS=278 ap=17 tcp=30 topuser=tubesupplies 2026-08-27 17:14:12 L1=0.90 run=1 blk=0 avail=6858 (58.5%) swpO=0 conn=3 myRSS=2729 php=0 phpRSS=0 ap=19 tcp=30 topuser=- 2026-08-27 17:14:12 L1=0.90 run=2 blk=0 avail=6858 (58.5%) swpO=0 conn=1 myRSS=2729 php=1 phpRSS=24 ap=19 tcp=30 topuser=evolution 2026-08-27 17:14:22 L1=0.84 run=2 blk=0 avail=6769 (57.7%) swpO=0 conn=3 myRSS=2729 php=1 phpRSS=111 ap=21 tcp=29 topuser=madalice 2026-08-27 17:14:22 L1=0.84 run=2 blk=0 avail=6765 (57.7%) swpO=0 conn=1 myRSS=2729 php=1 phpRSS=114 ap=21 tcp=29 topuser=madalice 2026-08-27 17:14:32 L1=0.87 run=2 blk=0 avail=6763 (57.7%) swpO=0 conn=3 myRSS=2729 php=1 phpRSS=125 ap=20 tcp=29 topuser=madalice 2026-08-27 17:14:32 L1=0.87 run=2 blk=0 avail=6759 (57.6%) swpO=0 conn=1 myRSS=2729 php=1 phpRSS=128 ap=20 tcp=29 topuser=madalice 2026-08-27 17:14:42 L1=0.74 run=1 blk=0 avail=6854 (58.4%) swpO=0 conn=3 myRSS=2729 php=0 phpRSS=0 ap=19 tcp=28 topuser=- 2026-08-27 17:14:42 L1=0.74 run=2 blk=0 avail=6853 (58.4%) swpO=0 conn=1 myRSS=2729 php=0 phpRSS=0 ap=19 tcp=28 topuser=- 2026-08-27 17:14:52 L1=0.62 run=1 blk=0 avail=6829 (58.2%) swpO=0 conn=3 myRSS=2729 php=0 phpRSS=0 ap=24 tcp=39 topuser=- 2026-08-27 17:14:52 L1=0.62 run=2 blk=0 avail=6826 (58.2%) swpO=0 conn=1 myRSS=2729 php=0 phpRSS=0 ap=24 tcp=39 topuser=- 2026-08-27 17:15:02 L1=1.40 run=5 blk=0 avail=6505 (55.5%) swpO=0 conn=5 myRSS=2729 php=4 phpRSS=419 ap=25 tcp=57 topuser=madalice 2026-08-27 17:15:02 L1=1.40 run=7 blk=0 avail=6493 (55.4%) swpO=0 conn=1 myRSS=2729 php=4 phpRSS=425 ap=25 tcp=56 topuser=madalice 2026-08-27 17:15:12 L1=2.93 run=4 blk=0 avail=6266 (53.4%) swpO=102 conn=5 myRSS=2725 php=2 phpRSS=261 ap=80 tcp=47 topuser=madalice 2026-08-27 17:15:12 L1=2.93 run=4 blk=0 avail=6265 (53.4%) swpO=102 conn=3 myRSS=2725 php=2 phpRSS=262 ap=80 tcp=49 topuser=madalice 2026-08-27 17:15:22 L1=3.74 run=15 blk=0 avail=5990 (51.1%) swpO=0 conn=5 myRSS=2725 php=13 phpRSS=872 ap=72 tcp=67 topuser=vinesit 2026-08-27 17:15:22 L1=3.74 run=17 blk=0 avail=5962 (50.8%) swpO=0 conn=3 myRSS=2725 php=13 phpRSS=874 ap=72 tcp=67 topuser=vinesit 2026-08-27 17:15:33 L1=5.92 run=20 blk=0 avail=5848 (49.9%) swpO=0 conn=5 myRSS=2725 php=14 phpRSS=1160 ap=63 tcp=71 topuser=vinesit 2026-08-27 17:15:33 L1=5.92 run=17 blk=0 avail=5820 (49.6%) swpO=0 conn=3 myRSS=2725 php=13 phpRSS=1109 ap=63 tcp=71 topuser=vinesit 2026-08-27 17:15:43 L1=7.09 run=21 blk=0 avail=5825 (49.7%) swpO=0 conn=5 myRSS=2725 php=18 phpRSS=1292 ap=62 tcp=66 topuser=vinesit 2026-08-27 17:15:43 L1=7.09 run=27 blk=0 avail=5812 (49.6%) swpO=0 conn=3 myRSS=2725 php=19 phpRSS=1342 ap=62 tcp=66 topuser=vinesit 2026-08-27 17:15:53 L1=7.25 run=19 blk=0 avail=5598 (47.7%) swpO=0 conn=21 myRSS=2725 php=21 phpRSS=1693 ap=53 tcp=72 topuser=vinesit 2026-08-27 17:15:53 L1=7.25 run=19 blk=0 avail=5597 (47.7%) swpO=0 conn=21 myRSS=2725 php=21 phpRSS=1694 ap=53 tcp=73 topuser=vinesit