INCIDENT 2026-08-29 04:13:19 trigger: php_rss=1768MB ================================================================== load: 2.74 2.24 1.94 10/733 1839288 ncpu:10 mem_avail: 6695MB/13777MB (48.6%) swap_used:1258MB swapout:0/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 12 procs / 1768MB heaviest user: madalice (10 procs, 1723MB) apache: 79 procs tcp_estab: 81 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2751 madalice 10 1947 nobody 78 1287 root 259 1122 mailman 20 229 netdata 7 208 cpanellogin 1 101 dovenull 6 59 infinium 4 58 wp-toolkit 3 53 lowrange 3 43 kurri 3 37 mailnull 3 31 evolution 7 29 zabbix 1 23 dovecot 3 23 named 1 16 aaa 1 15 vinesit 1 14 corpkicks 1 14 --- php workers by user --- USER PROCS RSS_MB madalice 10 1913 root 1 30 customc 1 23 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4084 MB Active(file): 4276 MB Inactive(file): 862 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1247 MB CommitLimit: 10984 MB Committed_AS: 9763 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-01:54:39 7504 /usr/bin/imunify-agent-proxy 1644966 root 54:18 3180 /bin/bash /etc/cron.daily/imunify-antivirus.cron 1644967 root 54:18 1228 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 1644968 root 54:18 9100 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 1644980 root 54:18 14608 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 1787129 root 13:19 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2817808 11.9 Ssl 1-01:54:08 /usr/sbin/mariadbd 1839153 510022 madalice 252536 45.0 R 00:08 php-fpm: pool madalice_com_au 1839152 510022 madalice 226712 44.2 R 00:08 php-fpm: pool madalice_com_au 1839151 510022 madalice 221532 43.6 R 00:08 php-fpm: pool madalice_com_au 1839122 510022 madalice 187212 46.0 S 00:12 php-fpm: pool madalice_com_au 1502903 1451906 root 184516 0.0 S 01:36:57 spamd child 508924 1 netdata 182692 2.0 Ssl 1-01:53:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 175572 0.0 Ss 01:50:12 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1502904 1451906 root 165196 0.0 S 01:36:57 spamd child 1839119 510022 madalice 162388 53.0 R 00:13 php-fpm: pool madalice_com_au 1839150 510022 madalice 160800 46.8 R 00:08 php-fpm: pool madalice_com_au 1839216 510022 madalice 159444 81.6 S 00:03 php-fpm: pool madalice_com_au 1839255 510022 madalice 154124 75.0 R 00:01 php-fpm: pool madalice_com_au 1839254 510022 madalice 127412 123 R 00:01 php-fpm: pool madalice_com_au 1839256 510022 madalice 127364 117 S 00:01 php-fpm: pool madalice_com_au 1416362 1353308 cpanellogin 103896 0.0 S 01:59:11 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 79332 0.0 Ss 1-01:53:34 /usr/lib/systemd/systemd-journald 1839286 1838046 customc 56964 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 509236 509098 root 49024 0.0 Sl 1-01:53:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41188 0.1 Ss 38-01:32:00 cpsrvd (SSL) - waiting for connections 1451116 1 root 36728 0.0 Ss 01:51:05 lfd - sleeping 510022 1 root 31376 0.0 Ss 1-01:53:30 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 31364 0.0 Ss 1-00:01:11 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509640 508992 root 30676 0.0 Sl 1-01:53:32 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1469 1 root 24160 0.1 Ss 60-18:03:29 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 483898 1 zabbix 24004 0.2 Ssl 1-01:54:51 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1838046 506832 nobody 22292 0.6 S 01:32 /usr/sbin/httpd -k start 1838124 506832 nobody 22212 0.0 R 01:31 /usr/sbin/httpd -k start 1822812 506832 nobody 21792 0.1 S 03:52 /usr/sbin/httpd -k start 1820291 506832 nobody 21780 0.0 S 07:14 /usr/sbin/httpd -k start 1463 1 root 21696 0.0 Ss 60-18:03:29 tailwatchd 1822817 506832 nobody 21600 0.0 S 03:52 /usr/sbin/httpd -k start 1838013 506832 nobody 21560 0.0 S 01:33 /usr/sbin/httpd -k start 1838039 506832 nobody 21508 0.0 S 01:32 /usr/sbin/httpd -k start 1838201 506832 nobody 21416 0.0 S 01:30 /usr/sbin/httpd -k start 1822854 506832 nobody 20956 0.0 S 03:51 /usr/sbin/httpd -k start 1838109 506832 nobody 20784 0.0 S 01:31 /usr/sbin/httpd -k start 938585 1 wp-toolkit 20460 0.0 Ss 1-00:01:11 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1838125 506832 nobody 20324 0.0 S 01:31 /usr/sbin/httpd -k start 1838206 506832 nobody 19728 0.0 S 01:30 /usr/sbin/httpd -k start 1839198 506832 nobody 19360 0.3 S 00:03 /usr/sbin/httpd -k start 1839218 506832 nobody 19320 1.0 S 00:02 /usr/sbin/httpd -k start 1839205 506832 nobody 19260 0.3 S 00:03 /usr/sbin/httpd -k start 1839168 506832 nobody 19256 0.5 S 00:04 /usr/sbin/httpd -k start 1838210 506832 nobody 19244 0.0 S 01:30 /usr/sbin/httpd -k start 1839169 506832 nobody 19232 0.2 S 00:04 /usr/sbin/httpd -k start 1839172 506832 nobody 19208 0.2 S 00:04 /usr/sbin/httpd -k start 1839200 506832 nobody 19192 0.3 S 00:03 /usr/sbin/httpd -k start 1822845 506832 nobody 19152 0.0 S 03:51 /usr/sbin/httpd -k start 509671 508992 netdata 17928 2.1 Rl 1-01:53:32 /usr/libexec/netdata/plugins.d/apps.plugin 1 1839199 506832 nobody 17892 0.0 S 00:03 /usr/sbin/httpd -k start 1839203 506832 nobody 17832 0.0 S 00:03 /usr/sbin/httpd -k start 481558 1 root 17456 0.1 Ssl 1-01:56:01 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1839202 506832 nobody 17076 0.0 S 00:03 /usr/sbin/httpd -k start 1839234 506832 nobody 17068 0.0 S 00:02 /usr/sbin/httpd -k start 1839236 506832 nobody 17068 0.0 S 00:02 /usr/sbin/httpd -k start 1839210 506832 nobody 17060 0.0 S 00:03 /usr/sbin/httpd -k start 1839160 506832 nobody 17012 0.0 S 00:05 /usr/sbin/httpd -k start 1839161 506832 nobody 17012 0.0 S 00:05 /usr/sbin/httpd -k start 1839167 506832 nobody 17012 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3816491 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 125 infinium/infinium.net.au-ssl_log 114 alison/alisonarts.com.au-ssl_log 70 customc/customcentral.com.au-ssl_log 61 nrg/nrgservices.net.au-ssl_log 56 olympic/olympicfencing.com.au-ssl_log 53 evolution/portal.evolutionerp.com.au-ssl_log 25 olympic/olympicfencing.com.au 17 madalice/madalice.com.au-ssl_log 10 vinesit/vinesit.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 125 20.104.104.62 124 52.139.37.240 104 130.185.123.55 64 20.151.129.194 58 20.104.68.135 25 203.54.180.238 6 118.127.40.55 2 84.246.212.174 2 50.6.108.183 2 35.237.32.156 2 212.227.154.251 2 209.42.21.221 2 20.191.45.212 2 123.160.223.74 2 114.119.146.16 --- top request paths across all vhosts (last 3 min) --- 99 GET /wp-login.php 25 GET /heartbeat.php 14 POST /wp-login.php 11 GET / 6 POST /wp-cron.php 4 GET /store/design-your-own-kids-shoes/ 4 GET /nv.php 4 GET /jw.php 4 GET /dvve.php 3 GET /rsjlrria.php 3 GET /replace.php 3 GET /or.php 3 GET /okxoby.php 3 GET /ile56.php 3 GET /gelap1.php 3 GET /esuutzzx.php 3 GET /em.php 3 GET /emmh.php 3 GET /edit.php 3 GET /doo.php --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 2 GET /wp5.php 1 GET /zwq13.php 1 GET /zv.php 1 GET /zs.php 1 GET /zq.php 1 GET /zogy1.php 1 GET /zi.php 1 GET /yw.php 1 GET /ys.php 1 GET /yl.php 1 GET /yj.php 1 GET /xxw.php -- last 10 requests -- 20.104.104.62 - - [29/Aug/2026:04:11:49 +1000] "GET /tq.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:50 +1000] "GET /od.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:50 +1000] "GET /jc.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:51 +1000] "GET /be.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:51 +1000] "GET /ci.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:51 +1000] "GET /cy.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:52 +1000] "GET /qi.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:52 +1000] "GET /om.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:53 +1000] "GET /pb.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [29/Aug/2026:04:11:53 +1000] "GET /sz.php HTTP/1.1" 404 5750 "-" "-" == infinium/infinium.net.au-ssl_log == -- top paths -- 99 GET /wp-login.php 14 POST /wp-login.php 1 GET /wp-json/wp/v2/users/me -- last 10 requests -- 209.42.21.221 - - [29/Aug/2026:04:11:50 +1000] "GET /wp-login.php HTTP/1.1" 200 2025 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 69.6.220.159 - - [29/Aug/2026:04:11:50 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 401 82 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 209.42.21.221 - - [29/Aug/2026:04:11:51 +1000] "POST /wp-login.php HTTP/1.1" 503 6748 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0. 84.246.212.174 - - [29/Aug/2026:04:12:08 +1000] "GET /wp-login.php HTTP/1.1" 200 2026 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 84.246.212.174 - - [29/Aug/2026:04:12:09 +1000] "POST /wp-login.php HTTP/1.1" 503 6748 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 212.227.154.251 - - [29/Aug/2026:04:12:11 +1000] "GET /wp-login.php HTTP/1.1" 200 2025 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 212.227.154.251 - - [29/Aug/2026:04:12:12 +1000] "POST /wp-login.php HTTP/1.1" 503 6748 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151. 50.6.108.183 - - [29/Aug/2026:04:12:20 +1000] "GET /wp-login.php HTTP/1.1" 200 2024 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 50.6.108.183 - - [29/Aug/2026:04:12:21 +1000] "POST /wp-login.php HTTP/1.1" 503 6748 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0 64.202.189.56 - - [29/Aug/2026:04:12:46 +1000] "GET /wp-login.php HTTP/1.1" 200 2025 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp-mail.php 1 GET /wp-good.php 1 GET /wpc.php 1 GET /wp-content/uploads/index.php 1 GET /wp-content/uploads/ 1 GET /wp-content/themes/admin.php 1 GET /wp-content/index.php -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:04:12:21 +1000] "GET /wp-content/uploads/index.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:21 +1000] "GET /ws83.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:22 +1000] "GET /atex1.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:24 +1000] "GET /archive.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:25 +1000] "GET /sagax1.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:27 +1000] "GET /wpc.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:28 +1000] "GET /fone1.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:30 +1000] "GET /ncx.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:31 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:04:12:33 +1000] "GET /zup.php73 HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 04:10:55 L1=1.80 run=4 blk=0 avail=8149 (59.2%) swpO=0 conn=1 myRSS=2751 php=5 phpRSS=380 ap=34 tcp=34 topuser=madalice 2026-08-29 04:10:58 L1=1.82 run=2 blk=0 avail=8065 (58.5%) swpO=0 conn=2 myRSS=2751 php=5 phpRSS=431 ap=31 tcp=37 topuser=madalice 2026-08-29 04:11:05 L1=1.67 run=2 blk=0 avail=8171 (59.3%) swpO=0 conn=2 myRSS=2751 php=6 phpRSS=452 ap=24 tcp=37 topuser=madalice 2026-08-29 04:11:08 L1=1.70 run=5 blk=0 avail=8014 (58.2%) swpO=0 conn=2 myRSS=2751 php=7 phpRSS=596 ap=22 tcp=39 topuser=madalice 2026-08-29 04:11:15 L1=1.73 run=2 blk=0 avail=8089 (58.7%) swpO=0 conn=2 myRSS=2751 php=6 phpRSS=545 ap=22 tcp=39 topuser=madalice 2026-08-29 04:11:18 L1=1.75 run=4 blk=0 avail=8178 (59.4%) swpO=0 conn=2 myRSS=2751 php=6 phpRSS=456 ap=22 tcp=39 topuser=madalice 2026-08-29 04:11:25 L1=1.77 run=3 blk=0 avail=8132 (59.0%) swpO=0 conn=2 myRSS=2751 php=6 phpRSS=499 ap=22 tcp=39 topuser=madalice 2026-08-29 04:11:28 L1=1.79 run=2 blk=0 avail=8134 (59.0%) swpO=0 conn=2 myRSS=2751 php=5 phpRSS=469 ap=22 tcp=41 topuser=madalice 2026-08-29 04:11:35 L1=1.88 run=3 blk=0 avail=8453 (61.4%) swpO=0 conn=2 myRSS=2751 php=4 phpRSS=130 ap=22 tcp=40 topuser=olympic 2026-08-29 04:11:39 L1=1.89 run=2 blk=0 avail=8441 (61.3%) swpO=0 conn=2 myRSS=2751 php=3 phpRSS=117 ap=22 tcp=40 topuser=alison 2026-08-29 04:11:45 L1=1.90 run=5 blk=0 avail=8373 (60.8%) swpO=0 conn=2 myRSS=2751 php=5 phpRSS=252 ap=23 tcp=42 topuser=alison 2026-08-29 04:11:49 L1=1.99 run=6 blk=0 avail=8266 (60.0%) swpO=0 conn=2 myRSS=2751 php=5 phpRSS=228 ap=37 tcp=104 topuser=alison 2026-08-29 04:11:55 L1=3.67 run=3 blk=0 avail=7800 (56.6%) swpO=0 conn=2 myRSS=2751 php=5 phpRSS=360 ap=81 tcp=44 topuser=madalice 2026-08-29 04:11:59 L1=3.62 run=6 blk=0 avail=7545 (54.8%) swpO=0 conn=2 myRSS=2751 php=6 phpRSS=664 ap=78 tcp=42 topuser=customc 2026-08-29 04:12:05 L1=3.61 run=5 blk=0 avail=7479 (54.3%) swpO=0 conn=5 myRSS=2751 php=7 phpRSS=713 ap=71 tcp=45 topuser=customc 2026-08-29 04:12:09 L1=3.61 run=7 blk=0 avail=7793 (56.6%) swpO=0 conn=2 myRSS=2751 php=7 phpRSS=527 ap=68 tcp=44 topuser=madalice 2026-08-29 04:12:16 L1=3.92 run=5 blk=0 avail=7344 (53.3%) swpO=0 conn=5 myRSS=2751 php=10 phpRSS=1007 ap=61 tcp=49 topuser=madalice 2026-08-29 04:12:19 L1=3.92 run=3 blk=0 avail=7785 (56.5%) swpO=0 conn=2 myRSS=2751 php=6 phpRSS=559 ap=58 tcp=42 topuser=madalice 2026-08-29 04:12:26 L1=3.93 run=6 blk=0 avail=7540 (54.7%) swpO=0 conn=5 myRSS=2751 php=11 phpRSS=1005 ap=51 tcp=41 topuser=madalice 2026-08-29 04:12:29 L1=3.93 run=5 blk=0 avail=7618 (55.3%) swpO=0 conn=2 myRSS=2751 php=9 phpRSS=891 ap=48 tcp=41 topuser=madalice 2026-08-29 04:12:36 L1=3.71 run=3 blk=0 avail=7782 (56.5%) swpO=0 conn=5 myRSS=2751 php=7 phpRSS=715 ap=41 tcp=37 topuser=madalice 2026-08-29 04:12:39 L1=3.71 run=5 blk=0 avail=7866 (57.1%) swpO=0 conn=2 myRSS=2751 php=7 phpRSS=663 ap=38 tcp=38 topuser=madalice 2026-08-29 04:12:46 L1=3.36 run=3 blk=0 avail=8186 (59.4%) swpO=0 conn=5 myRSS=2751 php=4 phpRSS=355 ap=31 tcp=34 topuser=madalice 2026-08-29 04:12:49 L1=3.36 run=5 blk=0 avail=8009 (58.1%) swpO=0 conn=3 myRSS=2751 php=7 phpRSS=653 ap=27 tcp=35 topuser=madalice 2026-08-29 04:12:56 L1=3.00 run=1 blk=0 avail=8394 (60.9%) swpO=0 conn=5 myRSS=2751 php=3 phpRSS=201 ap=21 tcp=32 topuser=madalice 2026-08-29 04:12:59 L1=3.00 run=2 blk=0 avail=8343 (60.6%) swpO=0 conn=3 myRSS=2751 php=4 phpRSS=292 ap=18 tcp=36 topuser=madalice 2026-08-29 04:13:06 L1=2.76 run=2 blk=0 avail=8529 (61.9%) swpO=0 conn=1 myRSS=2751 php=3 phpRSS=93 ap=17 tcp=36 topuser=customc 2026-08-29 04:13:09 L1=2.76 run=2 blk=0 avail=8166 (59.3%) swpO=0 conn=3 myRSS=2751 php=5 phpRSS=308 ap=17 tcp=39 topuser=madalice 2026-08-29 04:13:16 L1=2.74 run=7 blk=0 avail=7527 (54.6%) swpO=0 conn=1 myRSS=2751 php=9 phpRSS=1140 ap=32 tcp=77 topuser=madalice 2026-08-29 04:13:19 L1=2.74 run=12 blk=0 avail=6695 (48.6%) swpO=0 conn=11 myRSS=2751 php=12 phpRSS=1768 ap=79 tcp=81 topuser=madalice