INCIDENT 2026-08-29 02:02:58 trigger: php_rss=2040MB mysql_conn=18 ================================================================== load: 4.30 2.79 2.28 20/695 1381213 ncpu:10 mem_avail: 7023MB/13777MB (51.0%) swap_used:1247MB swapout:0/s blocked(D):0 running:26 iowait:0.1% steal:0.0% php: 22 procs / 2040MB heaviest user: infinium (15 procs, 1333MB) apache: 36 procs tcp_estab: 59 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2812 infinium 18 1515 root 264 1247 nobody 35 753 madalice 2 320 mailman 20 237 evolution 8 204 netdata 7 201 cpanellogin 1 105 olympic 1 78 dovenull 6 59 wp-toolkit 3 56 kurri 3 37 lowrange 2 29 zabbix 1 25 dovecot 3 23 mailnull 2 21 named 1 16 aaa 1 15 polkitd 1 8 --- php workers by user --- USER PROCS RSS_MB infinium 15 1503 madalice 2 320 evolution 2 189 root 2 129 olympic 1 79 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4484 MB Active(file): 3591 MB Inactive(file): 1591 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 1411 MB CommitLimit: 10984 MB Committed_AS: 8980 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 23:44:18 7432 /usr/bin/imunify-agent-proxy 1363632 root 02:58 1252 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2880088 12.6 Ssl 23:43:47 /usr/sbin/mariadbd 508924 1 netdata 179016 2.0 Ssl 23:43:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1202218 1202214 root 178480 0.7 S 51:57 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 529389 527476 root 171828 0.0 S 23:38:40 spamd child 1379517 510022 madalice 163868 11.7 S 01:49 php-fpm: pool madalice_com_au 1380157 510022 madalice 163836 7.7 S 01:02 php-fpm: pool madalice_com_au 1381167 1381017 infinium 126276 52.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381172 1380082 infinium 119824 52.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381164 1381018 infinium 118584 53.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381162 1380335 infinium 117336 51.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381165 1362803 infinium 116784 45.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381160 1381041 infinium 113352 47.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381170 1381040 infinium 113124 57.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381173 1380227 infinium 112168 49.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381161 1379949 infinium 111760 51.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1256643 1353308 cpanellogin 108004 0.0 S 35:10 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1381174 1378338 infinium 104840 46.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381169 1379947 infinium 103464 45.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381176 1379937 infinium 102724 46.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1381180 1361156 olympic 99008 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1203804 1202218 root 95512 98.3 R 50:42 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/evolution 527476 1 root 80280 0.0 Ss 23:40:19 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 71096 0.0 Ss 23:43:13 /usr/lib/systemd/systemd-journald 2985227 527476 root 69740 0.0 S 12:24:17 spamd child 509236 509098 root 53760 0.0 Sl 23:43:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42152 0.1 Ss 37-23:21:39 cpsrvd (SSL) - waiting for connections 939687 1 root 38080 0.0 Ss 02:02:57 lfd - sleeping 510022 1 root 37380 0.0 Ss 23:43:09 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 33592 0.0 Ss 21:50:50 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1381229 1469 root 29252 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1381183 1469 root 29240 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509640 508992 root 29104 0.0 Sl 23:43:11 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1361156 506832 nobody 26428 0.0 S 07:12 /usr/sbin/httpd -k start 483898 1 zabbix 26020 0.2 Ssl 23:44:30 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1361859 506832 nobody 25812 0.0 S 05:49 /usr/sbin/httpd -k start 1378338 506832 nobody 25492 0.0 S 02:32 /usr/sbin/httpd -k start 1362803 506832 nobody 24960 0.0 S 03:53 /usr/sbin/httpd -k start 1379963 506832 nobody 24464 0.1 S 01:16 /usr/sbin/httpd -k start 1379965 506832 nobody 24312 0.0 S 01:16 /usr/sbin/httpd -k start 1379964 506832 nobody 24188 0.0 S 01:16 /usr/sbin/httpd -k start 1469 1 root 24160 0.1 Ss 60-15:53:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1380082 506832 nobody 24120 0.1 S 01:08 /usr/sbin/httpd -k start 1379508 506832 nobody 23788 0.1 S 01:49 /usr/sbin/httpd -k start 1379642 506832 nobody 23724 0.1 S 01:43 /usr/sbin/httpd -k start 1379947 506832 nobody 23708 0.1 S 01:17 /usr/sbin/httpd -k start 1380285 506832 nobody 23592 0.0 S 00:54 /usr/sbin/httpd -k start 1378335 506832 nobody 23400 0.1 S 02:32 /usr/sbin/httpd -k start 1380077 506832 nobody 23300 0.0 S 01:09 /usr/sbin/httpd -k start 1380227 506832 nobody 23136 0.0 S 00:57 /usr/sbin/httpd -k start 1380226 506832 nobody 22912 0.1 S 00:57 /usr/sbin/httpd -k start 1380213 506832 nobody 22628 0.0 S 00:58 /usr/sbin/httpd -k start 1381039 506832 nobody 22536 0.0 S 00:09 /usr/sbin/httpd -k start 1379949 506832 nobody 22508 0.1 S 01:17 /usr/sbin/httpd -k start 1379948 506832 nobody 22504 0.0 S 01:17 /usr/sbin/httpd -k start 1378310 506832 nobody 22440 0.0 S 02:33 /usr/sbin/httpd -k start 1379937 506832 nobody 22244 0.0 S 01:18 /usr/sbin/httpd -k start 1379950 506832 nobody 22180 0.0 S 01:17 /usr/sbin/httpd -k start 1380966 506832 nobody 22108 0.1 S 00:11 /usr/sbin/httpd -k start 1380335 506832 nobody 22060 0.0 S 00:52 /usr/sbin/httpd -k start 1381040 506832 nobody 22004 0.1 S 00:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3772028 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1099 infinium/infinium.net.au-ssl_log 218 bigdeals/bigdeals.com.au-ssl_log 165 olympic/seb-mobile-auth.olympicfencing.com.au 151 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 151 candyfabcom/candyfab.com.au-ssl_log 146 olympic/olympicfencing.com.au-ssl_log 89 otter2/otterfencing.net.au-ssl_log 73 evolution/evolutionerp.com.au-ssl_log 59 evolution/evolutionerp.com.au 50 whiz/whizengineering.com.au-ssl_log 47 olympic/olympicfencing.com.au 45 evolution/portal.evolutionerp.com.au-ssl_log 30 customc/customcentral.com.au-ssl_log 25 madalice/madalice.com.au-ssl_log 24 (total vhosts taking traffic: 26) --- top client IPs across all vhosts (last 3 min) --- 1099 40.115.94.245 302 20.104.50.220 200 212.36.35.110 131 20.48.250.41 121 4.232.148.111 119 20.48.251.3 104 20.104.18.15 95 20.48.147.90 70 52.139.37.240 30 203.54.180.238 25 34.133.230.202 23 91.92.42.71 14 34.176.20.7 13 203.2.115.155 12 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 30 GET /heartbeat.php 24 POST /wp-login.php 23 GET / 21 GET /.well-known/webmcp 11 POST /wp-cron.php 9 GET /api/getItem/NA 8 POST /sse 8 POST /mcp/v1 8 POST /mcp/sse 8 POST /mcp 8 POST /api/mcp/v1 8 POST /api/mcp 8 POST / 7 POST /v4/mcp 7 POST /v3/mcp --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:02:01:19 +1000] "GET /api/getItem/PC15050 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:19 +1000] "GET /api/getItem/PC16 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:19 +1000] "GET /api/getItem/PC19 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:19 +1000] "GET /api/getItem/PC5025BL HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:19 +1000] "GET /api/getItem/PC7550 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:19 +1000] "GET /api/getItem/HCR-32 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:19 +1000] "GET /api/getItem/HCR-25 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:20 +1000] "GET /api/getItem/HCR-40 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:20 +1000] "GET /api/getItem/L2 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:02:01:20 +1000] "GET /api/getItem/FBM1230G HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == infinium/infinium.net.au-ssl_log == -- top paths -- 21 GET /.well-known/webmcp 12 GET / 8 POST /sse 8 POST /mcp/v1 8 POST /mcp/sse 8 POST /mcp 8 POST /api/mcp/v1 8 POST /api/mcp 7 POST /v4/mcp 7 POST /v3/mcp 7 POST /v1/mcp 7 POST /mcp-server -- last 10 requests -- 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /api/mcp/v2 HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /api/v1/mcp HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /api/mcp/mcp HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /api/mcp HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /v1/mcp HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /sse HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /mcp/mcp HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /api/mcp/v3 HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /mcp HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.36.35.110 - - [29/Aug/2026:02:02:57 +1000] "POST /mcp/v1 HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-the.php 1 GET /wp-signin.php 1 GET /wp-includes/pomo/up 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/media.php -- last 10 requests -- 20.48.147.90 - - [29/Aug/2026:02:02:48 +1000] "GET /img/file.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:48 +1000] "GET /cgi-bin/ty.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:49 +1000] "GET /wp-content/mu-plugins/jp.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:49 +1000] "GET /index/json.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:50 +1000] "GET /img/about.php7 HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:50 +1000] "GET /wp-content/plugins/defaults.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:51 +1000] "GET /about/mah.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:51 +1000] "GET /js/wp-damin.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:51 +1000] "GET /img/menu.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [29/Aug/2026:02:02:52 +1000] "GET /js/core.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 02:00:35 L1=2.98 run=6 blk=0 avail=7741 (56.2%) swpO=0 conn=1 myRSS=2817 php=8 phpRSS=772 ap=46 tcp=44 topuser=madalice 2026-08-29 02:00:37 L1=2.98 run=4 blk=0 avail=7898 (57.3%) swpO=0 conn=6 myRSS=2817 php=6 phpRSS=565 ap=44 tcp=43 topuser=madalice 2026-08-29 02:00:45 L1=2.90 run=6 blk=0 avail=7975 (57.9%) swpO=0 conn=1 myRSS=2817 php=6 phpRSS=544 ap=36 tcp=32 topuser=madalice 2026-08-29 02:00:47 L1=2.90 run=6 blk=0 avail=7956 (57.7%) swpO=0 conn=6 myRSS=2817 php=6 phpRSS=574 ap=34 tcp=36 topuser=madalice 2026-08-29 02:00:55 L1=3.07 run=7 blk=0 avail=8007 (58.1%) swpO=0 conn=1 myRSS=2817 php=6 phpRSS=563 ap=26 tcp=38 topuser=madalice 2026-08-29 02:00:57 L1=3.07 run=3 blk=0 avail=8079 (58.6%) swpO=0 conn=6 myRSS=2817 php=5 phpRSS=474 ap=25 tcp=37 topuser=evolution 2026-08-29 02:01:05 L1=3.28 run=5 blk=0 avail=8086 (58.7%) swpO=0 conn=1 myRSS=2817 php=6 phpRSS=520 ap=21 tcp=38 topuser=madalice 2026-08-29 02:01:07 L1=3.28 run=8 blk=0 avail=7995 (58.0%) swpO=0 conn=3 myRSS=2817 php=6 phpRSS=613 ap=21 tcp=37 topuser=evolution 2026-08-29 02:01:15 L1=3.45 run=8 blk=0 avail=7796 (56.6%) swpO=1 conn=1 myRSS=2817 php=10 phpRSS=912 ap=25 tcp=43 topuser=madalice 2026-08-29 02:01:17 L1=3.45 run=6 blk=0 avail=7870 (57.1%) swpO=1 conn=3 myRSS=2817 php=7 phpRSS=731 ap=26 tcp=40 topuser=madalice 2026-08-29 02:01:25 L1=3.37 run=5 blk=0 avail=7747 (56.2%) swpO=0 conn=4 myRSS=2817 php=8 phpRSS=845 ap=24 tcp=45 topuser=madalice 2026-08-29 02:01:27 L1=3.37 run=2 blk=0 avail=8033 (58.3%) swpO=0 conn=3 myRSS=2817 php=5 phpRSS=461 ap=24 tcp=45 topuser=madalice 2026-08-29 02:01:35 L1=3.16 run=3 blk=0 avail=8108 (58.9%) swpO=0 conn=4 myRSS=2817 php=5 phpRSS=409 ap=22 tcp=38 topuser=madalice 2026-08-29 02:01:37 L1=3.16 run=4 blk=0 avail=8184 (59.4%) swpO=0 conn=3 myRSS=2817 php=5 phpRSS=315 ap=22 tcp=40 topuser=madalice 2026-08-29 02:01:45 L1=3.14 run=5 blk=0 avail=8017 (58.2%) swpO=0 conn=4 myRSS=2817 php=5 phpRSS=396 ap=37 tcp=54 topuser=madalice 2026-08-29 02:01:47 L1=3.14 run=3 blk=0 avail=8086 (58.7%) swpO=0 conn=3 myRSS=2817 php=4 phpRSS=302 ap=36 tcp=42 topuser=madalice 2026-08-29 02:01:55 L1=3.05 run=5 blk=0 avail=8130 (59.0%) swpO=0 conn=4 myRSS=2817 php=4 phpRSS=346 ap=37 tcp=57 topuser=madalice 2026-08-29 02:01:57 L1=3.05 run=7 blk=0 avail=8024 (58.2%) swpO=0 conn=3 myRSS=2817 php=7 phpRSS=547 ap=37 tcp=42 topuser=madalice 2026-08-29 02:02:05 L1=3.27 run=4 blk=0 avail=7859 (57.0%) swpO=0 conn=4 myRSS=2817 php=7 phpRSS=630 ap=50 tcp=81 topuser=madalice 2026-08-29 02:02:07 L1=3.27 run=8 blk=0 avail=7717 (56.0%) swpO=0 conn=4 myRSS=2817 php=8 phpRSS=746 ap=58 tcp=68 topuser=madalice 2026-08-29 02:02:15 L1=3.16 run=6 blk=0 avail=7755 (56.3%) swpO=246 conn=4 myRSS=2812 php=8 phpRSS=755 ap=50 tcp=62 topuser=madalice 2026-08-29 02:02:18 L1=3.16 run=3 blk=0 avail=7975 (57.9%) swpO=223 conn=4 myRSS=2812 php=5 phpRSS=459 ap=48 tcp=57 topuser=madalice 2026-08-29 02:02:25 L1=3.37 run=4 blk=0 avail=7921 (57.5%) swpO=0 conn=3 myRSS=2812 php=9 phpRSS=735 ap=40 tcp=53 topuser=madalice 2026-08-29 02:02:28 L1=3.37 run=4 blk=0 avail=7920 (57.5%) swpO=0 conn=4 myRSS=2812 php=7 phpRSS=672 ap=39 tcp=54 topuser=madalice 2026-08-29 02:02:35 L1=4.68 run=8 blk=0 avail=7917 (57.5%) swpO=0 conn=3 myRSS=2812 php=11 phpRSS=815 ap=37 tcp=53 topuser=infinium 2026-08-29 02:02:38 L1=4.68 run=6 blk=0 avail=7887 (57.2%) swpO=0 conn=4 myRSS=2812 php=8 phpRSS=737 ap=37 tcp=53 topuser=madalice 2026-08-29 02:02:46 L1=4.19 run=4 blk=1 avail=8006 (58.1%) swpO=0 conn=3 myRSS=2812 php=7 phpRSS=662 ap=31 tcp=42 topuser=madalice 2026-08-29 02:02:48 L1=4.19 run=22 blk=0 avail=7586 (55.1%) swpO=0 conn=4 myRSS=2812 php=18 phpRSS=1459 ap=30 tcp=55 topuser=infinium 2026-08-29 02:02:56 L1=4.30 run=6 blk=0 avail=8005 (58.1%) swpO=0 conn=3 myRSS=2812 php=7 phpRSS=623 ap=37 tcp=41 topuser=madalice 2026-08-29 02:02:58 L1=4.30 run=26 blk=0 avail=7023 (51.0%) swpO=0 conn=18 myRSS=2812 php=22 phpRSS=2040 ap=36 tcp=59 topuser=infinium