INCIDENT 2026-08-29 10:05:01 trigger: php_rss=1745MB ================================================================== load: 2.81 1.83 1.44 11/696 3060175 ncpu:10 mem_avail: 6872MB/13777MB (49.9%) swap_used:1224MB swapout:0/s blocked(D):0 running:14 iowait:0.0% steal:0.0% php: 12 procs / 1745MB heaviest user: madalice (7 procs, 1363MB) apache: 39 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2823 madalice 7 1413 root 266 1180 nobody 38 653 mailman 20 225 netdata 7 206 customc 1 164 speedlin 1 146 evolution 15 76 cpanellogin 1 74 corpkicks 1 62 dovenull 6 59 wp-toolkit 3 51 mailnull 3 38 aaa 2 28 zabbix 1 24 dovecot 3 23 named 1 16 alison 1 13 kurri 1 9 --- php workers by user --- USER PROCS RSS_MB madalice 7 1204 customc 1 167 speedlin 1 150 corpkicks 1 64 root 1 30 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4502 MB Active(file): 4398 MB Inactive(file): 948 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 906 MB CommitLimit: 10984 MB Committed_AS: 8473 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-07:46:21 7768 /usr/bin/imunify-agent-proxy 3042173 root 05:00 1288 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3060086 root 00:00 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2890916 10.3 Ssl 1-07:45:50 /usr/sbin/mariadbd 3059994 510022 madalice 249324 31.8 R 00:09 php-fpm: pool madalice_com_au 3059019 510022 madalice 235288 15.6 R 01:24 php-fpm: pool madalice_com_au 1502903 1451906 root 193492 0.0 S 07:28:39 spamd child 3060070 3059252 customc 187572 112 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 508924 1 netdata 180676 2.0 Ssl 1-07:45:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 173948 0.0 Ss 07:41:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3059144 510022 madalice 159936 13.1 S 01:13 php-fpm: pool madalice_com_au 1502904 1451906 root 155148 0.0 S 07:28:39 spamd child 3060067 510022 madalice 135980 138 S 00:01 php-fpm: pool madalice_com_au 3060068 510022 madalice 127440 118 S 00:01 php-fpm: pool madalice_com_au 3060071 510022 madalice 127416 140 S 00:01 php-fpm: pool madalice_com_au 3060069 510022 madalice 127412 130 S 00:01 php-fpm: pool madalice_com_au 509266 1 root 92260 0.0 Ss 1-07:45:16 /usr/lib/systemd/systemd-journald 3060072 3059731 corpkicks 79944 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2971632 1353308 cpanellogin 75840 0.0 S 28:06 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 64368 0.0 Sl 1-07:45:16 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42276 0.1 Ss 38-07:23:42 cpsrvd (SSL) - waiting for connections 1451116 1 root 35992 0.0 Ss 07:42:47 lfd - sleeping 509640 508992 root 34636 0.0 Sl 1-07:45:14 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 31260 0.0 Ss 1-07:45:12 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 30760 0.0 Ss 1-05:52:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 25280 0.2 Ssl 1-07:46:33 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 24176 0.1 Ss 60-23:55:11 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3042082 506832 nobody 23628 0.1 S 05:08 /usr/sbin/httpd -k start 3040692 506832 nobody 23432 0.1 S 07:33 /usr/sbin/httpd -k start 3041066 506832 nobody 22700 0.2 S 07:00 /usr/sbin/httpd -k start 1463 1 root 21888 0.0 Ss 60-23:55:11 tailwatchd 3058229 506832 nobody 21812 0.1 S 02:51 /usr/sbin/httpd -k start 3042083 506832 nobody 21196 0.1 S 05:08 /usr/sbin/httpd -k start 3059455 506832 nobody 21080 0.0 S 00:45 /usr/sbin/httpd -k start 3059458 506832 nobody 21056 0.1 S 00:45 /usr/sbin/httpd -k start 3059252 506832 nobody 20804 0.0 S 01:03 /usr/sbin/httpd -k start 3059020 506832 nobody 20188 0.0 S 01:24 /usr/sbin/httpd -k start 3059456 506832 nobody 19868 0.0 S 00:45 /usr/sbin/httpd -k start 938585 1 wp-toolkit 19848 0.0 Ss 1-05:52:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3059658 506832 nobody 19716 0.0 S 00:31 /usr/sbin/httpd -k start 3059641 506832 nobody 19412 0.0 S 00:32 /usr/sbin/httpd -k start 3059026 506832 nobody 19072 0.0 S 01:24 /usr/sbin/httpd -k start 3059021 506832 nobody 19020 0.1 S 01:24 /usr/sbin/httpd -k start 3059447 506832 nobody 18948 0.0 S 00:47 /usr/sbin/httpd -k start 3058443 506832 nobody 18888 0.0 S 02:28 /usr/sbin/httpd -k start 3059554 506832 nobody 18816 0.0 S 00:38 /usr/sbin/httpd -k start 3059553 506832 nobody 18632 0.0 S 00:38 /usr/sbin/httpd -k start 3060113 3060111 root 18144 0.0 S 00:00 /usr/local/cpanel/bin/dcpumon 3059451 506832 nobody 18056 0.0 S 00:46 /usr/sbin/httpd -k start 3059723 506832 nobody 18024 0.0 S 00:28 /usr/sbin/httpd -k start 3059340 506832 nobody 17824 0.1 S 00:55 /usr/sbin/httpd -k start 509671 508992 netdata 17804 2.1 Rl 1-07:45:14 /usr/libexec/netdata/plugins.d/apps.plugin 1 3057673 506832 nobody 17772 0.1 S 03:51 /usr/sbin/httpd -k start 3059012 506832 nobody 17704 0.0 S 01:25 /usr/sbin/httpd -k start 3059712 506832 nobody 17672 0.0 S 00:29 /usr/sbin/httpd -k start 3059722 506832 nobody 17672 0.0 S 00:28 /usr/sbin/httpd -k start 3059709 506832 nobody 17656 0.0 S 00:29 /usr/sbin/httpd -k start 3059710 506832 nobody 17656 0.0 S 00:29 /usr/sbin/httpd -k start 3059706 506832 nobody 17608 0.0 S 00:29 /usr/sbin/httpd -k start 481558 1 root 17416 0.1 Ssl 1-07:47:43 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3059610 508720 mailnull 17380 0.0 S 00:33 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3059731 506832 nobody 17380 0.2 S 00:28 /usr/sbin/httpd -k start 3059708 506832 nobody 17212 0.0 S 00:29 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3925677 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3925666 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (30355,30215,24267,28038,28039,31435,27504,29650,31434,30358,30855,29710,33491,34411,30495,24095,24104,33648,28302,24099,30810,30812,30811,24101,24103,34413,31534,30494,29596,31153,31154,30813,31156,31155,31635,33533,33536, | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 149 aaa/aaadownunder.com.au-ssl_log 81 corpkicks/corporatekicks.com.au-ssl_log 81 speedlin/speedlinefencing.com.au-ssl_log 80 corpkicks/corporatekicks.com.au 74 speedlin/speedlinefencing.com.au 68 customc/customcentral.com.au-ssl_log 59 customc/customcentral.com.au 55 whiz/whizengineering.com.au-ssl_log 54 alison/alisonarts.com.au 27 alison/alisonarts.com.au-ssl_log 23 evolution/portal.evolutionerp.com.au-ssl_log 20 madalice/madalice.com.au-ssl_log 10 evolution/evolutionerp.com.au-ssl_log 5 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 152 158.23.147.79 149 34.81.157.26 113 20.48.147.90 112 20.220.10.235 74 20.104.68.135 54 93.123.109.53 51 4.204.200.136 36 34.122.255.166 20 203.54.180.238 8 216.73.217.13 7 118.127.40.55 2 143.244.57.120 1 57.141.16.24 1 34.196.51.17 1 2a03:2880:f802:31:: --- top request paths across all vhosts (last 3 min) --- 40 GET /_next/image 20 GET /heartbeat.php 19 GET / 5 POST /wp-cron.php 4 GET /wp-signup.php 4 GET /wp-login.php 3 GET /wp-cron.php 3 GET /wp-config.php.bak 3 GET /wp-config.php 3 GET /wp-conffg.php 3 GET /reop3.php 3 GET /manager.php 3 GET /goods.php 3 GET /.env.old 3 GET /.env.bak 3 GET /config.php 3 GET /chosen.php 3 GET /actuator/env 3 GET /actuator/configprops 3 GET /about.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /@fs/proc/self/environ 2 GET / 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /web/.env 1 GET /@vite/env 1 GET /v2/.env 1 GET /v1/graphql 1 GET /v1/.env 1 GET /uploads../.env 1 GET /.ssh/id_rsa -- last 10 requests -- 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /actuator/env HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Twitterbot/1.0) Chrome/131.0.1209.39 Mo 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /api/graphql HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /v1/graphql HTTP/1.1" 404 3417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +Claude-User@anthropic.com)" 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /actuator/configprops HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://open 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /.hermes/config.yaml HTTP/1.1" 404 3417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +Claude-User@anthropic.com)" 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /graphql/console HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /docker-compose.yml HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:78.8) Gecko/20100101 Firefox/78.8; compatible; LinkedInBot/1.0; +http://www.linkedin.com" 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /.hermes/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.327.213 Safari/537.36; compatible; Goog 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /actuator/mappings HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 34.81.157.26 - - [29/Aug/2026:10:05:02 +1000] "GET /.openclaw/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /xmrlpc.php 1 GET /wp.php 1 GET /wp-includes/Text/Diff/Renderer/ 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/Text 1 GET /wp-includes/sitemaps/ 1 GET /wp-includes/SimplePie/library/SimplePie/Copyright.php 1 GET /wp-includes/SimplePie/library/SimplePie/Category.php 1 GET /wp-includes/rest-api/search/ 1 GET /wp-includes/rest-api/fields/ 1 GET /wp-includes/js/crop/ -- last 10 requests -- 20.104.68.135 - - [29/Aug/2026:10:04:43 +1000] "GET /wp-includes/Text/Diff/Renderer/ HTTP/1.1" 200 308 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/certificates/ HTTP/1.1" 200 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/html-api/ HTTP/1.1" 200 569 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/js/ HTTP/1.1" 200 2088 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/rest-api/search/ HTTP/1.1" 200 392 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /xmrlpc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /akcc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /chosen.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /inc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /wp-admin/images/ HTTP/1.1" 200 1548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 HEAD / 1 GET /xpw.php 1 GET /wp-signup.php 1 GET /wp-login.php 1 GET /wp-links.php 1 GET /wp-includes/Text/autoload_classmap.php 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/IXR/index.php 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/customize/index.php 1 GET /wp-includes/css/index.php -- last 10 requests -- 158.23.147.79 - - [29/Aug/2026:10:04:23 +1000] "GET /wp-content/plugins/linkpreview/index.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:24 +1000] "GET /wp-content/cache/index.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:25 +1000] "GET /wp-admin/file.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:26 +1000] "GET /bak.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:28 +1000] "GET /config.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:29 +1000] "GET /wp-content/uploads/2025/03/themes.php HTTP/1.1" 403 12 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:29 +1000] "GET /wp-activate.php HTTP/1.1" 302 - "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:34 +1000] "GET /wp-login.php?action=register HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:38 +1000] "GET /wp-file.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:04:39 +1000] "GET /12.php HTTP/1.1" 403 6789 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 10:02:38 L1=1.68 run=4 blk=0 avail=8349 (60.6%) swpO=0 conn=4 myRSS=2823 php=5 phpRSS=306 ap=26 tcp=34 topuser=speedlin 2026-08-29 10:02:41 L1=1.87 run=3 blk=0 avail=8312 (60.3%) swpO=0 conn=2 myRSS=2823 php=4 phpRSS=306 ap=26 tcp=29 topuser=alison 2026-08-29 10:02:48 L1=1.88 run=5 blk=0 avail=8367 (60.7%) swpO=0 conn=4 myRSS=2823 php=6 phpRSS=334 ap=24 tcp=36 topuser=alison 2026-08-29 10:02:51 L1=2.05 run=3 blk=0 avail=8384 (60.9%) swpO=0 conn=1 myRSS=2823 php=4 phpRSS=252 ap=24 tcp=35 topuser=corpkicks 2026-08-29 10:02:58 L1=2.12 run=4 blk=0 avail=8380 (60.8%) swpO=0 conn=4 myRSS=2823 php=5 phpRSS=284 ap=24 tcp=35 topuser=customc 2026-08-29 10:03:01 L1=2.11 run=5 blk=0 avail=8419 (61.1%) swpO=0 conn=1 myRSS=2823 php=3 phpRSS=127 ap=24 tcp=32 topuser=speedlin 2026-08-29 10:03:08 L1=2.27 run=2 blk=0 avail=8429 (61.2%) swpO=0 conn=4 myRSS=2823 php=3 phpRSS=180 ap=23 tcp=33 topuser=speedlin 2026-08-29 10:03:11 L1=2.16 run=2 blk=0 avail=8454 (61.4%) swpO=0 conn=1 myRSS=2823 php=3 phpRSS=162 ap=23 tcp=30 topuser=alison 2026-08-29 10:03:18 L1=2.15 run=3 blk=0 avail=8360 (60.7%) swpO=0 conn=4 myRSS=2823 php=5 phpRSS=316 ap=22 tcp=32 topuser=madalice 2026-08-29 10:03:21 L1=2.14 run=3 blk=0 avail=8231 (59.7%) swpO=0 conn=1 myRSS=2823 php=5 phpRSS=446 ap=22 tcp=28 topuser=alison 2026-08-29 10:03:28 L1=2.13 run=3 blk=0 avail=8300 (60.2%) swpO=0 conn=4 myRSS=2823 php=5 phpRSS=376 ap=21 tcp=34 topuser=corpkicks 2026-08-29 10:03:31 L1=1.96 run=4 blk=0 avail=8197 (59.5%) swpO=0 conn=1 myRSS=2823 php=6 phpRSS=508 ap=22 tcp=35 topuser=madalice 2026-08-29 10:03:38 L1=2.60 run=6 blk=0 avail=8066 (58.5%) swpO=0 conn=6 myRSS=2823 php=7 phpRSS=553 ap=37 tcp=49 topuser=speedlin 2026-08-29 10:03:41 L1=2.47 run=7 blk=0 avail=8223 (59.7%) swpO=0 conn=1 myRSS=2823 php=6 phpRSS=372 ap=37 tcp=45 topuser=madalice 2026-08-29 10:03:48 L1=2.84 run=5 blk=0 avail=8259 (59.9%) swpO=0 conn=6 myRSS=2823 php=5 phpRSS=299 ap=31 tcp=34 topuser=madalice 2026-08-29 10:03:51 L1=2.93 run=4 blk=0 avail=8040 (58.4%) swpO=0 conn=3 myRSS=2823 php=6 phpRSS=537 ap=30 tcp=36 topuser=madalice 2026-08-29 10:03:58 L1=2.77 run=4 blk=0 avail=7961 (57.8%) swpO=0 conn=6 myRSS=2823 php=6 phpRSS=648 ap=30 tcp=70 topuser=madalice 2026-08-29 10:04:01 L1=2.71 run=3 blk=0 avail=8067 (58.6%) swpO=0 conn=3 myRSS=2823 php=6 phpRSS=542 ap=33 tcp=34 topuser=madalice 2026-08-29 10:04:08 L1=2.57 run=4 blk=0 avail=8066 (58.5%) swpO=0 conn=6 myRSS=2823 php=7 phpRSS=607 ap=28 tcp=38 topuser=madalice 2026-08-29 10:04:11 L1=2.61 run=5 blk=0 avail=7900 (57.3%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=777 ap=28 tcp=31 topuser=madalice 2026-08-29 10:04:18 L1=2.80 run=5 blk=0 avail=7963 (57.8%) swpO=0 conn=6 myRSS=2823 php=7 phpRSS=694 ap=31 tcp=36 topuser=madalice 2026-08-29 10:04:21 L1=2.90 run=6 blk=0 avail=7839 (56.9%) swpO=0 conn=3 myRSS=2823 php=8 phpRSS=775 ap=30 tcp=41 topuser=madalice 2026-08-29 10:04:28 L1=3.15 run=6 blk=0 avail=7879 (57.2%) swpO=0 conn=6 myRSS=2823 php=8 phpRSS=791 ap=32 tcp=44 topuser=madalice 2026-08-29 10:04:31 L1=3.21 run=5 blk=0 avail=7973 (57.9%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=649 ap=35 tcp=96 topuser=madalice 2026-08-29 10:04:38 L1=3.20 run=4 blk=0 avail=7927 (57.5%) swpO=0 conn=3 myRSS=2823 php=6 phpRSS=513 ap=60 tcp=34 topuser=madalice 2026-08-29 10:04:41 L1=3.26 run=5 blk=0 avail=7879 (57.2%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=602 ap=57 tcp=29 topuser=madalice 2026-08-29 10:04:48 L1=3.32 run=4 blk=0 avail=7872 (57.1%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=659 ap=51 tcp=32 topuser=madalice 2026-08-29 10:04:51 L1=3.13 run=4 blk=0 avail=7938 (57.6%) swpO=0 conn=4 myRSS=2823 php=7 phpRSS=610 ap=49 tcp=31 topuser=madalice 2026-08-29 10:04:58 L1=2.96 run=6 blk=0 avail=7389 (53.6%) swpO=0 conn=3 myRSS=2823 php=11 phpRSS=1309 ap=42 tcp=43 topuser=evolution 2026-08-29 10:05:01 L1=2.81 run=14 blk=0 avail=6872 (49.9%) swpO=0 conn=9 myRSS=2823 php=12 phpRSS=1745 ap=39 tcp=46 topuser=madalice