INCIDENT 2026-08-29 08:52:06 trigger: mysql_conn=15 ================================================================== load: 1.78 1.73 1.72 2/647 2817953 ncpu:10 mem_avail: 8065MB/13777MB (58.5%) swap_used:1196MB swapout:2/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 5 procs / 514MB heaviest user: madalice (3 procs, 469MB) apache: 20 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2838 root 249 1146 madalice 3 469 nobody 19 337 mailman 20 227 netdata 7 203 infinium 4 132 cpanellogin 1 127 lowrange 2 62 dovenull 6 59 wp-toolkit 3 52 kurri 3 37 mailnull 3 32 evolution 7 29 dovecot 3 23 zabbix 1 22 named 1 16 polkitd 1 8 nscd 1 5 rpc 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 3 469 root 1 30 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4527 MB Active(file): 4639 MB Inactive(file): 856 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1011 MB CommitLimit: 10984 MB Committed_AS: 7084 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-06:33:26 7768 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2906176 10.6 Ssl 1-06:32:55 /usr/sbin/mariadbd 1502903 1451906 root 191572 0.0 S 06:15:44 spamd child 508924 1 netdata 177544 2.0 Ssl 1-06:32:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 175424 0.0 Ss 06:28:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2816688 510022 madalice 163508 37.1 R 01:55 php-fpm: pool madalice_com_au 1502904 1451906 root 160748 0.0 S 06:15:44 spamd child 2817680 510022 madalice 159872 25.2 S 00:35 php-fpm: pool madalice_com_au 2802601 510022 madalice 158188 41.8 S 02:21 php-fpm: pool madalice_com_au 1416362 1353308 cpanellogin 130988 0.0 S 06:37:58 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 90412 0.0 Ss 1-06:32:21 /usr/lib/systemd/systemd-journald 509236 509098 root 65472 0.0 Sl 1-06:32:21 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2817804 1353308 infinium 54928 0.6 S 00:18 webmaild - serving 1.41.252.211 2783442 508511 lowrange 48800 0.0 S 08:59 dovecot/imap 2783445 508511 infinium 44760 0.0 S 08:59 dovecot/imap 1353308 1 root 41184 0.1 Ss 38-06:10:47 cpsrvd (SSL) - waiting for connections 1451116 1 root 36768 0.0 Ss 06:29:52 lfd - sleeping 509640 508992 root 33844 0.0 Sl 1-06:32:19 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 31264 0.0 Ss 1-06:32:17 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 30944 0.0 Ss 1-04:39:58 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2817928 1469 root 29428 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 24176 0.1 Ss 60-22:42:16 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 483898 1 zabbix 23432 0.2 Ssl 1-06:33:38 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 21800 0.0 Ss 60-22:42:16 tailwatchd 2816939 506832 nobody 21752 0.0 S 01:22 /usr/sbin/httpd -k start 2817235 506832 nobody 21556 0.0 S 01:02 /usr/sbin/httpd -k start 2816942 506832 nobody 21456 0.0 S 01:21 /usr/sbin/httpd -k start 2817806 938407 infinium 21216 0.2 S 00:18 php-fpm: pool user_infinium 2802610 506832 nobody 21156 0.0 S 02:21 /usr/sbin/httpd -k start 2817449 506832 nobody 20896 0.0 S 01:01 /usr/sbin/httpd -k start 2816972 506832 nobody 20740 0.0 S 01:19 /usr/sbin/httpd -k start 2802598 506832 nobody 20304 0.6 S 02:22 /usr/sbin/httpd -k start 2817448 506832 nobody 20296 0.0 S 01:01 /usr/sbin/httpd -k start 2817485 506832 nobody 20132 0.0 S 01:00 /usr/sbin/httpd -k start 938585 1 wp-toolkit 20088 0.0 Ss 1-04:39:58 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2817488 506832 nobody 20068 0.0 S 01:00 /usr/sbin/httpd -k start 2816962 506832 nobody 19656 0.0 S 01:19 /usr/sbin/httpd -k start 2817490 506832 nobody 19544 0.0 S 01:00 /usr/sbin/httpd -k start 2817777 506832 nobody 19164 0.0 S 00:21 /usr/sbin/httpd -k start 2817750 506832 nobody 18960 0.0 S 00:22 /usr/sbin/httpd -k start 509671 508992 netdata 17916 2.1 Sl 1-06:32:19 /usr/libexec/netdata/plugins.d/apps.plugin 1 2817498 506832 nobody 17616 0.0 S 01:00 /usr/sbin/httpd -k start 481558 1 root 17420 0.1 Ssl 1-06:34:48 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 2817800 506832 nobody 17292 0.0 S 00:20 /usr/sbin/httpd -k start 2766563 1471 root 16900 0.0 S 14:18 cPhulkd - dbprocessor 508634 1 named 16628 0.0 Ssl 1-06:32:29 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2817797 506832 nobody 15572 0.0 S 00:20 /usr/sbin/httpd -k start 1471 1 root 15416 0.0 Ss 60-22:42:16 cPhulkd - processor 2802038 1471 root 15352 0.0 S 03:18 cPhulkd - processor - http socket 607605 508511 lowrange 15064 0.0 S 10:30:48 dovecot/imap 4180059 4180015 evolution 14888 0.0 Ss 1-08:52:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2801975 508511 kurri 14636 0.0 S 03:28 dovecot/imap 2817919 508511 kurri 14572 0.0 S 00:05 dovecot/imap 2801971 508511 infinium 14504 0.0 S 03:29 dovecot/imap 508856 508814 mailman 14460 0.0 S 1-06:32:27 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508865 508814 mailman 14432 0.0 S 1-06:32:27 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 506832 1 root 13632 0.0 Ss 1-06:32:54 /usr/sbin/httpd -k start 508855 508814 mailman 13620 0.0 S 1-06:32:27 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508857 508814 mailman 13332 0.0 S 1-06:32:27 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508854 508814 mailman 13252 0.0 S 1-06:32:27 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508861 508814 mailman 13096 0.0 S 1-06:32:27 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3904621 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min infinium/infinium.net.au-ssl_log 123 kamcool/kamcool.com.au-ssl_log 68 madalice/madalice.com.au-ssl_log 60 alison/alisonarts.com.au-ssl_log 34 evolution/portal.evolutionerp.com.au-ssl_log 22 speedlin/speedlinefencing.com.au-ssl_log 10 otter2/otterfencing.net.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 112 143.95.209.25 68 20.203.141.11 53 4.204.200.136 22 34.13.11.233 22 203.54.180.238 8 118.127.40.55 3 34.221.157.147 2 66.116.251.167 2 34.16.27.129 2 34.14.60.202 2 213.227.139.244 2 172.93.101.38 2 162.215.121.77 2 149.118.56.192 1 91.92.243.251 --- top request paths across all vhosts (last 3 min) --- 76 GET /wp-json/wp/v2/users/me 34 GET /wp-login.php 22 GET /heartbeat.php 15 POST /wp-login.php 9 POST / 3 GET /k.php 2 GET /zoo1.php 2 GET /ws85.php 2 GET /simple.php 2 GET /robots.txt 2 GET /m.php 2 GET /fling.php 2 GET /chosen.php 2 GET /atomlib.php 2 GET /admin.php 2 GET /1.php 1 POST /wp-cron.php 1 GET /zup.php73 1 GET /zoo2.php 1 GET /x.php --- busiest 3 vhosts: top paths + last 10 requests --- == infinium/infinium.net.au-ssl_log == -- top paths -- 76 GET /wp-json/wp/v2/users/me 31 GET /wp-login.php 15 POST /wp-login.php 1 POST /wp-cron.php -- last 10 requests -- 143.95.209.25 - - [29/Aug/2026:08:51:08 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 143.95.209.25 - - [29/Aug/2026:08:51:08 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 143.95.209.25 - - [29/Aug/2026:08:51:08 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 143.95.209.25 - - [29/Aug/2026:08:51:09 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 213.227.139.244 - - [29/Aug/2026:08:51:10 +1000] "GET /wp-login.php HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 143.95.209.25 - - [29/Aug/2026:08:51:12 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 213.227.139.244 - - [29/Aug/2026:08:51:13 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 66.116.251.167 - - [29/Aug/2026:08:51:29 +1000] "GET /wp-login.php HTTP/1.1" 200 2026 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 66.116.251.167 - - [29/Aug/2026:08:51:31 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 84.246.212.174 - - [29/Aug/2026:08:51:33 +1000] "GET /wp-login.php HTTP/1.1" 200 2025 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/fonts/ 1 GET /wp-good.php 1 GET /wpc.php 1 GET /wp-content/uploads/index.php -- last 10 requests -- 20.203.141.11 - - [29/Aug/2026:08:50:16 +1000] "GET /k.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:17 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:17 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:17 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:17 +1000] "GET /wp-content/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:18 +1000] "GET /ww5.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:18 +1000] "GET /2.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:18 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:19 +1000] "GET /atomlib.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:08:50:19 +1000] "GET /rip.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 POST / 2 GET /zoo1.php 2 GET /ws85.php 2 GET /m.php 2 GET /k.php 2 GET /fling.php 2 GET /admin.php 2 GET /1.php 1 GET /zoo2.php 1 GET /wsd.php 1 GET /tag/rewards/ 1 GET /store/custom-nike-af1-sunflower-kids/ -- last 10 requests -- 4.204.200.136 - - [29/Aug/2026:08:51:09 +1000] "GET /admin.php HTTP/1.1" 404 36641 "-" "-" 4.204.200.136 - - [29/Aug/2026:08:51:11 +1000] "GET /ws85.php?p= HTTP/1.1" 301 1 "-" "-" 4.204.200.136 - - [29/Aug/2026:08:51:12 +1000] "GET /ws85.php HTTP/1.1" 404 36644 "-" "-" 45.3.50.66 - - [29/Aug/2026:08:51:13 +1000] "GET /tag/rewards/ HTTP/1.1" 200 35492 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 4.204.200.136 - - [29/Aug/2026:08:51:14 +1000] "GET /ffs.php HTTP/1.1" 404 36644 "-" "-" 4.204.200.136 - - [29/Aug/2026:08:51:15 +1000] "GET /nano.php HTTP/1.1" 404 36643 "-" "-" 4.204.200.136 - - [29/Aug/2026:08:51:17 +1000] "GET /ano.php HTTP/1.1" 404 36644 "-" "-" 4.204.200.136 - - [29/Aug/2026:08:51:19 +1000] "GET /mgrr.php HTTP/1.1" 404 36646 "-" "-" 4.204.200.136 - - [29/Aug/2026:08:51:20 +1000] "GET /mac.php HTTP/1.1" 404 36642 "-" "-" 4.204.200.136 - - [29/Aug/2026:08:51:22 +1000] "GET /simple.php HTTP/1.1" 404 36644 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 08:49:39 L1=0.57 run=1 blk=0 avail=8510 (61.8%) swpO=0 conn=1 myRSS=2838 php=2 phpRSS=45 ap=16 tcp=31 topuser=root 2026-08-29 08:49:44 L1=0.57 run=2 blk=0 avail=8445 (61.3%) swpO=0 conn=3 myRSS=2838 php=2 phpRSS=45 ap=23 tcp=57 topuser=root 2026-08-29 08:49:49 L1=0.79 run=3 blk=0 avail=8069 (58.6%) swpO=0 conn=1 myRSS=2838 php=3 phpRSS=223 ap=45 tcp=51 topuser=madalice 2026-08-29 08:49:54 L1=0.88 run=3 blk=0 avail=8091 (58.7%) swpO=0 conn=3 myRSS=2838 php=6 phpRSS=413 ap=40 tcp=49 topuser=madalice 2026-08-29 08:49:59 L1=0.89 run=2 blk=0 avail=8177 (59.4%) swpO=0 conn=1 myRSS=2838 php=3 phpRSS=274 ap=35 tcp=46 topuser=madalice 2026-08-29 08:50:04 L1=0.98 run=5 blk=0 avail=8118 (58.9%) swpO=0 conn=3 myRSS=2838 php=6 phpRSS=435 ap=30 tcp=36 topuser=madalice 2026-08-29 08:50:09 L1=1.06 run=2 blk=0 avail=8313 (60.3%) swpO=0 conn=1 myRSS=2838 php=3 phpRSS=200 ap=25 tcp=37 topuser=madalice 2026-08-29 08:50:14 L1=1.06 run=4 blk=0 avail=8152 (59.2%) swpO=0 conn=4 myRSS=2838 php=6 phpRSS=469 ap=20 tcp=35 topuser=madalice 2026-08-29 08:50:19 L1=1.21 run=1 blk=0 avail=8209 (59.6%) swpO=0 conn=1 myRSS=2838 php=4 phpRSS=355 ap=20 tcp=35 topuser=madalice 2026-08-29 08:50:24 L1=1.12 run=2 blk=0 avail=8208 (59.6%) swpO=2 conn=4 myRSS=2838 php=6 phpRSS=435 ap=17 tcp=33 topuser=madalice 2026-08-29 08:50:29 L1=1.03 run=3 blk=0 avail=8231 (59.7%) swpO=2 conn=2 myRSS=2838 php=4 phpRSS=356 ap=17 tcp=31 topuser=madalice 2026-08-29 08:50:34 L1=0.94 run=2 blk=0 avail=8219 (59.7%) swpO=0 conn=4 myRSS=2838 php=6 phpRSS=433 ap=16 tcp=33 topuser=madalice 2026-08-29 08:50:39 L1=0.87 run=2 blk=0 avail=8226 (59.7%) swpO=0 conn=2 myRSS=2838 php=4 phpRSS=360 ap=17 tcp=32 topuser=madalice 2026-08-29 08:50:44 L1=0.88 run=4 blk=0 avail=8204 (59.5%) swpO=0 conn=4 myRSS=2838 php=5 phpRSS=419 ap=17 tcp=50 topuser=madalice 2026-08-29 08:50:49 L1=1.05 run=4 blk=0 avail=7995 (58.0%) swpO=0 conn=2 myRSS=2838 php=5 phpRSS=430 ap=47 tcp=60 topuser=madalice 2026-08-29 08:50:54 L1=0.96 run=4 blk=0 avail=7968 (57.8%) swpO=0 conn=4 myRSS=2838 php=8 phpRSS=546 ap=45 tcp=41 topuser=madalice 2026-08-29 08:50:59 L1=1.13 run=2 blk=0 avail=8071 (58.6%) swpO=0 conn=2 myRSS=2838 php=4 phpRSS=379 ap=40 tcp=33 topuser=madalice 2026-08-29 08:51:04 L1=2.40 run=19 blk=0 avail=7224 (52.4%) swpO=0 conn=15 myRSS=2838 php=20 phpRSS=1734 ap=39 tcp=82 topuser=infinium 2026-08-29 08:51:09 L1=2.29 run=3 blk=0 avail=7829 (56.8%) swpO=0 conn=2 myRSS=2838 php=4 phpRSS=363 ap=66 tcp=33 topuser=madalice 2026-08-29 08:51:16 L1=2.26 run=3 blk=0 avail=7786 (56.5%) swpO=0 conn=3 myRSS=2838 php=5 phpRSS=482 ap=60 tcp=35 topuser=madalice 2026-08-29 08:51:19 L1=2.24 run=2 blk=0 avail=7851 (57.0%) swpO=0 conn=2 myRSS=2838 php=4 phpRSS=416 ap=56 tcp=33 topuser=madalice 2026-08-29 08:51:26 L1=2.14 run=4 blk=0 avail=7916 (57.5%) swpO=0 conn=3 myRSS=2838 php=4 phpRSS=400 ap=50 tcp=30 topuser=madalice 2026-08-29 08:51:30 L1=2.21 run=2 blk=0 avail=7986 (58.0%) swpO=0 conn=2 myRSS=2838 php=4 phpRSS=362 ap=46 tcp=31 topuser=madalice 2026-08-29 08:51:36 L1=2.11 run=4 blk=0 avail=7797 (56.6%) swpO=0 conn=3 myRSS=2838 php=6 phpRSS=657 ap=40 tcp=33 topuser=madalice 2026-08-29 08:51:40 L1=2.10 run=2 blk=0 avail=7905 (57.4%) swpO=1 conn=2 myRSS=2838 php=5 phpRSS=566 ap=36 tcp=29 topuser=madalice 2026-08-29 08:51:46 L1=2.02 run=11 blk=0 avail=7092 (51.5%) swpO=1 conn=15 myRSS=2838 php=19 phpRSS=1820 ap=31 tcp=54 topuser=alison 2026-08-29 08:51:50 L1=2.01 run=4 blk=0 avail=7734 (56.1%) swpO=0 conn=2 myRSS=2838 php=7 phpRSS=779 ap=37 tcp=45 topuser=madalice 2026-08-29 08:51:56 L1=1.93 run=2 blk=0 avail=7993 (58.0%) swpO=0 conn=15 myRSS=2838 php=5 phpRSS=511 ap=30 tcp=33 topuser=madalice 2026-08-29 08:52:00 L1=1.94 run=4 blk=0 avail=7937 (57.6%) swpO=2 conn=2 myRSS=2838 php=5 phpRSS=608 ap=27 tcp=34 topuser=madalice 2026-08-29 08:52:06 L1=1.78 run=2 blk=0 avail=8065 (58.5%) swpO=2 conn=15 myRSS=2838 php=5 phpRSS=514 ap=20 tcp=35 topuser=madalice