INCIDENT 2026-08-29 08:27:22 trigger: php_rss=1629MB mysql_conn=15 ================================================================== load: 1.17 1.89 1.64 18/678 2730637 ncpu:10 mem_avail: 7284MB/13777MB (52.9%) swap_used:1193MB swapout:0/s blocked(D):0 running:18 iowait:0.1% steal:0.0% php: 19 procs / 1629MB heaviest user: infinium (14 procs, 1108MB) apache: 35 procs tcp_estab: 88 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2832 infinium 14 1317 root 250 1156 nobody 34 601 madalice 3 476 mailman 20 228 netdata 7 207 cpanellogin 1 129 dovenull 6 59 wp-toolkit 3 52 kurri 4 52 mailnull 5 51 lowrange 2 29 evolution 7 29 zabbix 1 23 dovecot 3 23 named 1 16 polkitd 1 8 nscd 1 5 rpc 1 4 --- php workers by user --- USER PROCS RSS_MB infinium 14 1348 madalice 3 476 root 1 30 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4527 MB Active(file): 4624 MB Inactive(file): 900 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1011 MB CommitLimit: 10984 MB Committed_AS: 8549 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-06:08:42 7768 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2900008 10.7 Ssl 1-06:08:11 /usr/sbin/mariadbd 1502903 1451906 root 189784 0.0 S 05:51:00 spamd child 508924 1 netdata 182416 2.0 Ssl 1-06:07:40 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 175424 0.0 Ss 06:04:15 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2714866 510022 madalice 163240 8.5 S 02:53 php-fpm: pool madalice_com_au 2714869 510022 madalice 162636 7.8 S 02:53 php-fpm: pool madalice_com_au 2714863 510022 madalice 161804 8.4 S 02:53 php-fpm: pool madalice_com_au 1502904 1451906 root 161340 0.0 S 05:51:00 spamd child 1416362 1353308 cpanellogin 132536 0.0 S 06:13:14 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2730586 2715140 infinium 126960 52.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730588 2715202 infinium 125780 52.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730591 2730258 infinium 125584 55.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730590 2730268 infinium 118968 48.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730597 2730290 infinium 103580 46.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730594 2714219 infinium 102628 38.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730593 2730215 infinium 100516 36.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730598 2730263 infinium 98032 34.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730599 2712795 infinium 93892 36.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730589 2714218 infinium 92520 32.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730600 2730265 infinium 92272 34.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509266 1 root 89620 0.0 Ss 1-06:07:37 /usr/lib/systemd/systemd-journald 2730592 2714780 infinium 78792 27.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2730596 2715192 infinium 75020 24.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509236 509098 root 65472 0.0 Sl 1-06:07:37 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41196 0.1 Ss 38-05:46:03 cpsrvd (SSL) - waiting for connections 1451116 1 root 36764 0.0 Ss 06:05:08 lfd - sleeping 509640 508992 root 33580 0.0 Sl 1-06:07:35 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 31272 0.0 Ss 1-06:07:33 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 30952 0.0 Ss 1-04:15:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2730634 1469 root 29156 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 483898 1 zabbix 24252 0.2 Ssl 1-06:08:54 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 24176 0.1 Ss 60-22:17:32 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2714218 506832 nobody 24016 0.0 S 03:57 /usr/sbin/httpd -k start 2714219 506832 nobody 23004 0.0 S 03:57 /usr/sbin/httpd -k start 2715192 506832 nobody 22240 0.0 S 02:29 /usr/sbin/httpd -k start 2715140 506832 nobody 22180 0.0 S 02:34 /usr/sbin/httpd -k start 2714780 506832 nobody 22108 0.1 S 03:02 /usr/sbin/httpd -k start 2715202 506832 nobody 22088 0.0 S 02:28 /usr/sbin/httpd -k start 2715201 506832 nobody 21928 0.0 S 02:28 /usr/sbin/httpd -k start 1463 1 root 21792 0.0 Ss 60-22:17:32 tailwatchd 2730267 506832 nobody 21652 0.1 S 00:23 /usr/sbin/httpd -k start 2715203 506832 nobody 21392 0.0 S 02:28 /usr/sbin/httpd -k start 2730290 506832 nobody 21312 0.0 S 00:22 /usr/sbin/httpd -k start 2712795 506832 nobody 21196 0.1 S 06:25 /usr/sbin/httpd -k start 2730268 506832 nobody 21168 0.1 S 00:23 /usr/sbin/httpd -k start 2730259 506832 nobody 21000 0.0 S 00:24 /usr/sbin/httpd -k start 2730215 506832 nobody 20324 0.0 S 00:26 /usr/sbin/httpd -k start 2730278 506832 nobody 20304 0.0 S 00:22 /usr/sbin/httpd -k start 2730258 506832 nobody 20264 0.0 S 00:24 /usr/sbin/httpd -k start 938585 1 wp-toolkit 20096 0.0 Ss 1-04:15:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2730263 506832 nobody 20012 0.0 S 00:23 /usr/sbin/httpd -k start 2730293 506832 nobody 19948 0.0 S 00:22 /usr/sbin/httpd -k start 2729691 506832 nobody 19280 0.0 S 01:34 /usr/sbin/httpd -k start 2730578 506832 nobody 19024 0.0 S 00:02 /usr/sbin/httpd -k start 2730579 506832 nobody 19024 0.0 S 00:02 /usr/sbin/httpd -k start 2730557 506832 nobody 18964 0.0 S 00:03 /usr/sbin/httpd -k start 2730265 506832 nobody 18492 0.0 S 00:23 /usr/sbin/httpd -k start 2730283 506832 nobody 18280 0.0 S 00:22 /usr/sbin/httpd -k start 509671 508992 netdata 17916 2.1 Sl 1-06:07:35 /usr/libexec/netdata/plugins.d/apps.plugin 1 2730282 506832 nobody 17832 0.0 S 00:22 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3896649 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olytis/tis.com.au-ssl_log 121 otterfencing/otterfencing.com.au-ssl_log 66 speedlin/speedlinefencing.com.au-ssl_log 57 alison/alisonarts.com.au-ssl_log 40 evolution/portal.evolutionerp.com.au-ssl_log 26 madalice/madalice.com.au-ssl_log 25 tubesupplies/tubesupplies.com.au-ssl_log 15 aaa/aaadownunder.com.au-ssl_log 7 vinesit/vinesit.com.au-ssl_log 5 corpkicks/2025.corporatekicks.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 3 infinium/infinium.net.au-ssl_log 3 olympic/olympicfencing.com.au 1 olympic/olympicfencing.com.au-ssl_log 1 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 121 20.151.129.194 67 158.23.184.117 49 52.139.37.240 38 158.23.147.79 26 203.54.180.238 18 209.42.18.204 15 103.73.53.4 5 118.127.40.55 4 46.105.39.50 4 213.111.144.104 4 198.187.31.44 3 103.73.53.156 2 51.68.236.70 2 209.50.163.103 2 198.235.24.59 --- top request paths across all vhosts (last 3 min) --- 26 GET /heartbeat.php 25 POST /wp-login.php 24 GET /wp-login.php 12 GET / 4 POST /wp-cron.php 4 GET /robots.txt 2 GET /xxx.php 2 GET /wp-content/plugins/akismet/ 2 GET /wp-conffg.php 2 GET /services/trailer-manufacturing/ 2 GET /services/sheds/ 2 GET /services/rural/ 2 GET /services/fencing-solutions/ 2 GET /radio.php 2 GET /mini.php 2 GET /lock360.php 2 GET /gecko.php 2 GET /flower.php 2 GET /f35.php 2 GET /defaults.php --- busiest 3 vhosts: top paths + last 10 requests --- == olytis/tis.com.au-ssl_log == -- top paths -- 2 GET /wp-conffg.php 1 GET /zrjuyoos.php 1 GET /zi.php 1 GET /zfqipfss.php 1 GET /yj.php 1 GET /xr.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php -- last 10 requests -- 20.151.129.194 - - [29/Aug/2026:08:25:48 +1000] "GET /wp_motu_myk3v.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:49 +1000] "GET /wp_motu_ypdat.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:49 +1000] "GET /edit.php?p= HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:50 +1000] "GET /tqkdqbbv.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:50 +1000] "GET /kjyehoxl.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:51 +1000] "GET /llyuxaqd.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:51 +1000] "GET /nbwxolou.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:51 +1000] "GET /nsxeubyv.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:52 +1000] "GET /zfqipfss.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [29/Aug/2026:08:25:52 +1000] "GET /zrjuyoos.php HTTP/1.1" 404 5749 "-" "-" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /WZGHHra0r3.php 1 GET /wpsml-sys.php 1 GET /wp-signin.php 1 GET /wp-setup.php 1 GET /wp-setting.php 1 GET /wp-file.php 1 GET /wp-conf.php 1 GET /user.php 1 GET /updates.php 1 GET /thickbox.php 1 GET /task.php -- last 10 requests -- 158.23.184.117 - - [29/Aug/2026:08:25:55 +1000] "GET /bugz.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:55 +1000] "GET /fox.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:55 +1000] "GET /profile.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:55 +1000] "GET /task.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:55 +1000] "GET /thickbox.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:56 +1000] "GET /wp-setting.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:56 +1000] "GET /aa.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:56 +1000] "GET /abc.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:56 +1000] "GET /fff.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:08:25:56 +1000] "GET /loadme.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 4 GET / 3 GET /robots.txt 1 GET /zup.php 1 GET /z.php 1 GET /xxx.php 1 GET /ww2.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-info.php 1 GET /wp-index.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/Engine/ -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:08:25:10 +1000] "GET /files/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:08:25:10 +1000] "GET /flower.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 103.73.53.156 - - [29/Aug/2026:08:25:48 +1000] "GET /robots.txt HTTP/1.1" 200 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.156 - - [29/Aug/2026:08:25:49 +1000] "GET / HTTP/1.1" 200 89484 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.156 - - [29/Aug/2026:08:25:52 +1000] "GET / HTTP/1.1" 200 89484 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e 46.105.39.50 - - [29/Aug/2026:08:26:53 +1000] "GET /robots.txt HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)" 46.105.39.50 - - [29/Aug/2026:08:26:55 +1000] "GET /robots.txt HTTP/1.1" 200 110 "-" "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)" 46.105.39.50 - - [29/Aug/2026:08:26:57 +1000] "GET / HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)" 46.105.39.50 - - [29/Aug/2026:08:26:59 +1000] "GET / HTTP/1.1" 200 15337 "-" "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)" 103.73.53.60 - - [29/Aug/2026:08:27:11 +1000] "GET /contact-us/ HTTP/1.1" 200 13258 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 08:24:57 L1=3.21 run=1 blk=0 avail=7589 (55.1%) swpO=0 conn=4 myRSS=2832 php=8 phpRSS=996 ap=31 tcp=44 topuser=madalice 2026-08-29 08:25:01 L1=3.03 run=4 blk=0 avail=7195 (52.2%) swpO=0 conn=4 myRSS=2832 php=11 phpRSS=1495 ap=30 tcp=35 topuser=madalice 2026-08-29 08:25:07 L1=3.99 run=2 blk=0 avail=7510 (54.5%) swpO=1 conn=2 myRSS=2832 php=8 phpRSS=1073 ap=28 tcp=41 topuser=madalice 2026-08-29 08:25:11 L1=3.83 run=2 blk=0 avail=7616 (55.3%) swpO=1 conn=4 myRSS=2832 php=8 phpRSS=1001 ap=27 tcp=27 topuser=madalice 2026-08-29 08:25:17 L1=3.92 run=1 blk=0 avail=7775 (56.4%) swpO=0 conn=2 myRSS=2832 php=7 phpRSS=840 ap=24 tcp=34 topuser=madalice 2026-08-29 08:25:21 L1=3.61 run=5 blk=0 avail=7664 (55.6%) swpO=0 conn=3 myRSS=2832 php=9 phpRSS=1027 ap=23 tcp=32 topuser=madalice 2026-08-29 08:25:27 L1=3.32 run=3 blk=0 avail=7864 (57.1%) swpO=0 conn=2 myRSS=2832 php=8 phpRSS=824 ap=20 tcp=30 topuser=madalice 2026-08-29 08:25:31 L1=3.21 run=4 blk=0 avail=7841 (56.9%) swpO=0 conn=3 myRSS=2832 php=8 phpRSS=851 ap=20 tcp=31 topuser=madalice 2026-08-29 08:25:37 L1=2.96 run=2 blk=0 avail=8093 (58.7%) swpO=0 conn=2 myRSS=2832 php=5 phpRSS=517 ap=20 tcp=30 topuser=madalice 2026-08-29 08:25:41 L1=2.72 run=2 blk=0 avail=8099 (58.8%) swpO=0 conn=3 myRSS=2832 php=5 phpRSS=521 ap=20 tcp=28 topuser=madalice 2026-08-29 08:25:47 L1=2.50 run=4 blk=0 avail=7937 (57.6%) swpO=0 conn=2 myRSS=2832 php=8 phpRSS=779 ap=18 tcp=36 topuser=madalice 2026-08-29 08:25:51 L1=2.46 run=1 blk=0 avail=8087 (58.7%) swpO=0 conn=3 myRSS=2832 php=5 phpRSS=520 ap=21 tcp=33 topuser=madalice 2026-08-29 08:25:57 L1=2.34 run=1 blk=0 avail=8084 (58.7%) swpO=0 conn=2 myRSS=2832 php=5 phpRSS=519 ap=21 tcp=34 topuser=madalice 2026-08-29 08:26:01 L1=2.16 run=2 blk=0 avail=8095 (58.8%) swpO=0 conn=3 myRSS=2832 php=5 phpRSS=519 ap=20 tcp=28 topuser=madalice 2026-08-29 08:26:07 L1=1.98 run=1 blk=0 avail=8114 (58.9%) swpO=0 conn=1 myRSS=2832 php=5 phpRSS=519 ap=18 tcp=29 topuser=madalice 2026-08-29 08:26:12 L1=1.82 run=1 blk=0 avail=8040 (58.4%) swpO=0 conn=3 myRSS=2832 php=5 phpRSS=592 ap=18 tcp=31 topuser=madalice 2026-08-29 08:26:17 L1=1.68 run=1 blk=0 avail=8147 (59.1%) swpO=1 conn=1 myRSS=2832 php=5 phpRSS=502 ap=17 tcp=31 topuser=madalice 2026-08-29 08:26:22 L1=1.62 run=3 blk=0 avail=7953 (57.7%) swpO=1 conn=3 myRSS=2832 php=6 phpRSS=723 ap=17 tcp=30 topuser=madalice 2026-08-29 08:26:27 L1=1.49 run=1 blk=0 avail=8120 (58.9%) swpO=0 conn=1 myRSS=2832 php=5 phpRSS=521 ap=17 tcp=27 topuser=madalice 2026-08-29 08:26:32 L1=1.37 run=2 blk=0 avail=8121 (58.9%) swpO=0 conn=3 myRSS=2832 php=6 phpRSS=558 ap=17 tcp=28 topuser=madalice 2026-08-29 08:26:37 L1=1.26 run=2 blk=0 avail=8076 (58.6%) swpO=0 conn=1 myRSS=2832 php=5 phpRSS=521 ap=17 tcp=29 topuser=madalice 2026-08-29 08:26:42 L1=1.32 run=2 blk=0 avail=8036 (58.3%) swpO=0 conn=3 myRSS=2832 php=5 phpRSS=593 ap=17 tcp=26 topuser=madalice 2026-08-29 08:26:47 L1=1.22 run=2 blk=0 avail=8127 (59.0%) swpO=0 conn=1 myRSS=2832 php=5 phpRSS=527 ap=16 tcp=27 topuser=madalice 2026-08-29 08:26:52 L1=1.12 run=1 blk=0 avail=8145 (59.1%) swpO=0 conn=3 myRSS=2832 php=5 phpRSS=520 ap=16 tcp=23 topuser=madalice 2026-08-29 08:26:57 L1=1.27 run=3 blk=0 avail=8017 (58.2%) swpO=0 conn=1 myRSS=2832 php=6 phpRSS=649 ap=16 tcp=49 topuser=madalice 2026-08-29 08:27:02 L1=1.17 run=2 blk=0 avail=7741 (56.2%) swpO=0 conn=3 myRSS=2832 php=6 phpRSS=750 ap=46 tcp=45 topuser=madalice 2026-08-29 08:27:07 L1=1.23 run=2 blk=0 avail=7961 (57.8%) swpO=0 conn=1 myRSS=2832 php=5 phpRSS=522 ap=41 tcp=43 topuser=madalice 2026-08-29 08:27:12 L1=1.21 run=2 blk=0 avail=7923 (57.5%) swpO=0 conn=3 myRSS=2832 php=5 phpRSS=594 ap=36 tcp=39 topuser=madalice 2026-08-29 08:27:17 L1=1.28 run=2 blk=0 avail=7885 (57.2%) swpO=0 conn=1 myRSS=2832 php=6 phpRSS=693 ap=31 tcp=38 topuser=madalice 2026-08-29 08:27:22 L1=1.17 run=18 blk=0 avail=7284 (52.9%) swpO=0 conn=15 myRSS=2832 php=19 phpRSS=1629 ap=35 tcp=88 topuser=infinium