INCIDENT 2026-08-27 21:47:30 trigger: php_rss=1629MB ================================================================== load: 2.18 1.41 1.25 18/688 3732369 ncpu:10 mem_avail: 7158MB/13777MB (52.0%) swap_used:2385MB swapout:73/s blocked(D):0 running:19 iowait:0.1% steal:0.0% php: 15 procs / 1629MB heaviest user: tubesupplies (14 procs, 1587MB) apache: 43 procs tcp_estab: 104 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2865 tubesupplies 14 1462 root 241 812 nobody 42 650 netdata 8 259 cpanellogin 1 83 mailman 20 47 dovenull 6 44 mailnull 5 25 wp-toolkit 6 18 dovecot 3 17 zabbix 1 15 aaa 1 15 corpkicks 1 14 kurri 1 7 named 1 6 nscd 1 5 cpanelconnecttrack 1 3 evolution 4 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB tubesupplies 14 1228 root 1 42 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6169 MB Active(file): 4682 MB Inactive(file): 1178 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 488 MB CommitLimit: 10984 MB Committed_AS: 8908 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 20:36:14 3292 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2934116 16.1 Ssl 2-18:16:14 /usr/sbin/mariadbd 1220 1 netdata 205660 2.5 Ssl 59-11:37:40 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1910875 3797563 root 171384 0.1 S 08:33:38 spamd child 3732290 3732288 tubesupplies 156084 36.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3846467 3797563 root 152004 0.0 S 19:11:56 spamd child 3732309 3732305 tubesupplies 150000 32.7 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732308 3731974 tubesupplies 149944 34.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732315 3731276 tubesupplies 149724 32.0 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732313 3716736 tubesupplies 124600 27.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732323 3731264 tubesupplies 113860 48.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732333 3732041 tubesupplies 112588 46.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732324 3731540 tubesupplies 110236 46.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2805458 1353308 cpanellogin 85432 0.0 S 04:28:02 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 78696 0.0 Ss 12-13:57:01 /usr/lib/systemd/systemd-journald 3797563 1 root 78656 0.0 Ss 19:24:34 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3732336 3732317 tubesupplies 71216 42.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732347 3732047 tubesupplies 56972 17.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732365 3731937 tubesupplies 54536 15.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732378 3731472 tubesupplies 47016 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3732366 3732011 tubesupplies 46900 6.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 45000 0.0 Sl 59-11:37:39 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3066250 1 root 43124 0.0 Ss 03:16:05 php-fpm: master process (/opt/cpanel/ea-php82/root/etc/php-fpm.conf) 1353308 1 root 41104 0.0 Ss 36-19:06:10 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33520 0.1 Sl 59-11:37:35 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3716777 3066150 nobody 22696 0.0 S 02:46 /usr/sbin/httpd -k start 3716735 3066150 nobody 22040 0.0 S 02:47 /usr/sbin/httpd -k start 3716736 3066150 nobody 21540 0.0 S 02:47 /usr/sbin/httpd -k start 1469 1 root 20868 0.1 Ss 59-11:37:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 185104 2431 netdata 20024 2.1 Sl 15-01:13:58 /usr/libexec/netdata/plugins.d/apps.plugin 1 3731472 3066150 nobody 19472 0.0 S 00:54 /usr/sbin/httpd -k start 3731276 3066150 nobody 19364 0.0 S 01:03 /usr/sbin/httpd -k start 3731540 3066150 nobody 19204 0.0 S 00:50 /usr/sbin/httpd -k start 3732011 3066150 nobody 19052 0.0 S 00:29 /usr/sbin/httpd -k start 3732042 3066150 nobody 19048 0.0 S 00:28 /usr/sbin/httpd -k start 3732041 3066150 nobody 19032 0.0 S 00:28 /usr/sbin/httpd -k start 3732010 3066150 nobody 18976 0.0 S 00:29 /usr/sbin/httpd -k start 3731183 3066150 nobody 18592 0.0 S 01:09 /usr/sbin/httpd -k start 3732040 3066150 nobody 18508 0.0 S 00:28 /usr/sbin/httpd -k start 3731925 3066150 nobody 18492 0.0 S 00:32 /usr/sbin/httpd -k start 3731937 3066150 nobody 18400 0.0 S 00:31 /usr/sbin/httpd -k start 3731264 3066150 nobody 18396 0.0 S 01:04 /usr/sbin/httpd -k start 3732050 3066150 nobody 18376 0.0 S 00:28 /usr/sbin/httpd -k start 3732048 3066150 nobody 18328 0.0 S 00:28 /usr/sbin/httpd -k start 3731973 3066150 nobody 18264 0.0 S 00:30 /usr/sbin/httpd -k start 3731971 3066150 nobody 18244 0.0 S 00:30 /usr/sbin/httpd -k start 3732037 3066150 nobody 18240 0.0 S 00:28 /usr/sbin/httpd -k start 3732047 3066150 nobody 18240 0.0 S 00:28 /usr/sbin/httpd -k start 3732045 3066150 nobody 18168 0.0 S 00:28 /usr/sbin/httpd -k start 3731936 3066150 nobody 18140 0.0 S 00:31 /usr/sbin/httpd -k start 3731972 3066150 nobody 18136 0.0 S 00:30 /usr/sbin/httpd -k start 3731974 3066150 nobody 18060 0.0 S 00:30 /usr/sbin/httpd -k start 3732288 3066150 nobody 17948 0.0 S 00:05 /usr/sbin/httpd -k start 3732306 3066150 nobody 17936 0.0 S 00:04 /usr/sbin/httpd -k start 3732317 3066150 nobody 17276 0.0 S 00:03 /usr/sbin/httpd -k start 3732305 3066150 nobody 17224 0.0 S 00:04 /usr/sbin/httpd -k start 3731171 3828812 aaa 16120 0.0 S 01:10 dovecot/imap 1204 1 zabbix 15976 0.2 Ssl 59-11:37:40 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3732198 3828812 corpkicks 14624 0.0 S 00:18 dovecot/imap 1463 1 root 14176 0.0 Ss 59-11:37:39 tailwatchd 3066150 1 root 14172 0.0 Ss 03:16:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 13986371 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 163 evolution/evolutionerp.com.au-ssl_log 88 speedlin/speedlinefencing.com.au-ssl_log 78 kamcool/kamcool.com.au-ssl_log 71 evolution/portal.evolutionerp.com.au-ssl_log 18 evolution/my.evolutionerp.com.au-ssl_log 16 alison/alisonarts.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 152 20.104.50.220 86 52.139.37.240 77 20.104.18.15 71 20.63.81.20 18 203.54.180.238 15 175.36.227.212 4 136.108.89.82 1 91.92.243.239 1 74.248.24.12 1 50.6.207.27 1 44.213.202.136 1 40.77.167.73 1 2a01:e34:ec27:2530:6c4c:21e9:970d:ee60 1 2001:861:36c2:3b60:7db3:d752:3c40:11a2 1 136.65.248.224 --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 6 GET /app/ajax.php 4 POST /functions.php 4 GET /admin.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /store/sketchycartoon-af1-us12/ 3 GET /nox.php 3 GET /media.php 3 GET /mac.php 2 GET /zoo2.php 2 GET /zoo1.php 2 GET /xty.php 2 GET /wsd.php 2 GET /ws85.php 2 GET /wpxml.php 2 GET /w3lls.php 2 GET /w3llscc.php 2 GET /simple.php 2 GET /shell.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/sketchycartoon-af1-us12/ 2 GET /customizing-nike-shoes/ 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /zeal.php 1 GET /ynz.PhP7 1 GET /yasnu.php 1 GET /xwpg.php 1 GET /wuasr.php 1 GET /wso.php 1 GET /ws61.php -- last 10 requests -- 20.104.50.220 - - [27/Aug/2026:21:46:31 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 3421 "-" "-" 20.104.50.220 - - [27/Aug/2026:21:46:31 +1000] "GET /yasnu.php HTTP/1.1" 404 3421 "-" "-" 20.104.50.220 - - [27/Aug/2026:21:46:31 +1000] "GET /koala.php HTTP/1.1" 404 3421 "-" "-" 20.104.50.220 - - [27/Aug/2026:21:46:32 +1000] "GET /ms-edit.php HTTP/1.1" 404 3421 "-" "-" 20.104.50.220 - - [27/Aug/2026:21:46:32 +1000] "GET /v3.php HTTP/1.1" 404 3421 "-" "-" 114.119.159.70 - - [27/Aug/2026:21:46:32 +1000] "GET /store/sketchycartoon-af1-us12/?amp%3Brating=2&wcpr_verified=1&wcpr_rating=5&wcpr_page=2 HTTP/1.1" 500 - "https://madalice.com.au/store/sketchycartoon-af1-us12/?amp%3B 136.108.89.82 - - [27/Aug/2026:21:46:34 +1000] "POST /graphql HTTP/1.1" 500 - "https://madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.89.82 - - [27/Aug/2026:21:46:35 +1000] "POST /api/graphql HTTP/1.1" 500 - "https://madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 136.108.89.82 - - [27/Aug/2026:21:46:35 +1000] "POST /v1/graphql HTTP/1.1" 500 - "https://madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.89.82 - - [27/Aug/2026:21:46:38 +1000] "GET /blog/ HTTP/1.1" 500 - "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ww2.php 1 GET /ws80.php 1 GET /ws49.php 1 GET /wp/wp-admin/includes/ 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-login.php -- last 10 requests -- 52.139.37.240 - - [27/Aug/2026:21:46:33 +1000] "GET /wp-content/themes/seotheme/mar.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 52.139.37.240 - - [27/Aug/2026:21:46:33 +1000] "GET /wp-includes/Text/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:34 +1000] "GET /wp-includes/rest-api/fields/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:34 +1000] "GET /wp-index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:34 +1000] "GET /wp/wp-admin/includes/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:34 +1000] "GET /ws80.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:34 +1000] "GET /ww2.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:35 +1000] "GET /7logs.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:35 +1000] "GET /ac.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:21:46:35 +1000] "GET /assets/images/doc.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /admin.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /wpxml.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /w3lls.php 1 GET /w3llscc.php 1 GET /this_is_a_new_hello_world.php 1 GET /t3.php -- last 10 requests -- 20.104.18.15 - - [27/Aug/2026:21:46:57 +1000] "GET /fpwch.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:46:58 +1000] "GET /domvf.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:46:58 +1000] "GET /biufile.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:46:59 +1000] "GET /ammika.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:46:59 +1000] "GET /aogyvlbb.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:47:00 +1000] "GET /blacks.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:47:00 +1000] "GET /czq.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:47:00 +1000] "GET /beck.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:47:01 +1000] "GET /gkjjk.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [27/Aug/2026:21:47:01 +1000] "GET /t3.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-27 21:45:03 L1=1.73 run=2 blk=0 avail=8415 (61.1%) swpO=0 conn=1 myRSS=2867 php=2 phpRSS=111 ap=30 tcp=19 topuser=evolution 2026-08-27 21:45:09 L1=1.67 run=2 blk=0 avail=8466 (61.4%) swpO=0 conn=1 myRSS=2867 php=2 phpRSS=112 ap=24 tcp=17 topuser=evolution 2026-08-27 21:45:13 L1=1.78 run=4 blk=0 avail=8467 (61.5%) swpO=0 conn=1 myRSS=2867 php=3 phpRSS=174 ap=20 tcp=20 topuser=evolution 2026-08-27 21:45:19 L1=1.64 run=1 blk=0 avail=8537 (62.0%) swpO=0 conn=1 myRSS=2867 php=2 phpRSS=112 ap=14 tcp=16 topuser=evolution 2026-08-27 21:45:23 L1=1.51 run=1 blk=0 avail=8583 (62.3%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=13 tcp=17 topuser=root 2026-08-27 21:45:29 L1=1.39 run=2 blk=0 avail=8438 (61.2%) swpO=0 conn=2 myRSS=2867 php=2 phpRSS=218 ap=13 tcp=18 topuser=evolution 2026-08-27 21:45:33 L1=1.27 run=1 blk=0 avail=8581 (62.3%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=13 tcp=17 topuser=root 2026-08-27 21:45:39 L1=1.17 run=4 blk=0 avail=8489 (61.6%) swpO=0 conn=2 myRSS=2867 php=3 phpRSS=201 ap=13 tcp=18 topuser=olympic 2026-08-27 21:45:44 L1=1.24 run=1 blk=0 avail=8582 (62.3%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=14 tcp=20 topuser=root 2026-08-27 21:45:49 L1=1.14 run=2 blk=0 avail=8587 (62.3%) swpO=0 conn=2 myRSS=2867 php=1 phpRSS=42 ap=14 tcp=17 topuser=root 2026-08-27 21:45:54 L1=1.05 run=1 blk=0 avail=8585 (62.3%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=14 tcp=21 topuser=root 2026-08-27 21:45:59 L1=0.96 run=1 blk=0 avail=8584 (62.3%) swpO=0 conn=2 myRSS=2867 php=1 phpRSS=42 ap=14 tcp=20 topuser=root 2026-08-27 21:46:04 L1=0.89 run=1 blk=0 avail=8587 (62.3%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=14 tcp=21 topuser=root 2026-08-27 21:46:10 L1=0.81 run=3 blk=0 avail=8417 (61.1%) swpO=0 conn=2 myRSS=2867 php=4 phpRSS=306 ap=14 tcp=21 topuser=aaa 2026-08-27 21:46:14 L1=0.91 run=2 blk=0 avail=8568 (62.2%) swpO=0 conn=1 myRSS=2867 php=2 phpRSS=94 ap=14 tcp=19 topuser=aaa 2026-08-27 21:46:20 L1=0.84 run=1 blk=0 avail=8579 (62.3%) swpO=0 conn=2 myRSS=2867 php=1 phpRSS=42 ap=14 tcp=18 topuser=root 2026-08-27 21:46:24 L1=0.77 run=1 blk=0 avail=8561 (62.1%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=15 tcp=26 topuser=root 2026-08-27 21:46:30 L1=0.71 run=1 blk=0 avail=8533 (61.9%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=18 tcp=26 topuser=root 2026-08-27 21:46:34 L1=0.65 run=2 blk=0 avail=8534 (61.9%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=18 tcp=26 topuser=root 2026-08-27 21:46:40 L1=0.60 run=3 blk=0 avail=8401 (61.0%) swpO=0 conn=1 myRSS=2867 php=3 phpRSS=235 ap=20 tcp=28 topuser=olympic 2026-08-27 21:46:44 L1=0.63 run=1 blk=0 avail=8525 (61.9%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=21 tcp=27 topuser=root 2026-08-27 21:46:50 L1=0.66 run=2 blk=0 avail=8385 (60.9%) swpO=0 conn=1 myRSS=2867 php=3 phpRSS=251 ap=19 tcp=28 topuser=corpkicks 2026-08-27 21:46:54 L1=0.77 run=3 blk=0 avail=8538 (62.0%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=19 tcp=25 topuser=root 2026-08-27 21:47:00 L1=0.71 run=1 blk=0 avail=8515 (61.8%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=22 tcp=45 topuser=root 2026-08-27 21:47:04 L1=0.73 run=1 blk=0 avail=8338 (60.5%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=50 tcp=38 topuser=root 2026-08-27 21:47:10 L1=0.70 run=3 blk=0 avail=8139 (59.1%) swpO=0 conn=1 myRSS=2867 php=3 phpRSS=335 ap=44 tcp=37 topuser=corpkicks 2026-08-27 21:47:14 L1=0.70 run=1 blk=0 avail=8400 (61.0%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=40 tcp=26 topuser=root 2026-08-27 21:47:20 L1=0.59 run=4 blk=0 avail=8436 (61.2%) swpO=0 conn=1 myRSS=2867 php=2 phpRSS=83 ap=34 tcp=22 topuser=root 2026-08-27 21:47:24 L1=0.59 run=1 blk=0 avail=8477 (61.5%) swpO=0 conn=1 myRSS=2867 php=1 phpRSS=42 ap=30 tcp=21 topuser=root 2026-08-27 21:47:30 L1=2.18 run=19 blk=0 avail=7158 (52.0%) swpO=73 conn=12 myRSS=2865 php=15 phpRSS=1629 ap=43 tcp=104 topuser=tubesupplies