INCIDENT 2026-08-29 16:50:54 trigger: php_rss=1686MB mysql_conn=16 ================================================================== load: 1.70 1.58 1.40 14/664 270980 ncpu:10 mem_avail: 7371MB/13777MB (53.5%) swap_used:1485MB swapout:0/s blocked(D):0 running:17 iowait:0.0% steal:0.0% php: 19 procs / 1686MB heaviest user: customc (14 procs, 1409MB) apache: 26 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2806 customc 16 1535 root 249 1041 nobody 25 434 netdata 7 202 mailman 20 190 madalice 1 155 evolution 9 106 infinium 2 85 cpanellogin 1 63 dovenull 6 56 wp-toolkit 3 43 mailnull 4 37 zabbix 1 23 dovecot 3 22 named 1 16 kurri 1 13 polkitd 1 6 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB customc 16 1571 madalice 1 155 evolution 3 92 root 1 27 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4613 MB Active(file): 4330 MB Inactive(file): 844 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 559 MB CommitLimit: 10984 MB Committed_AS: 8530 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-14:32:14 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2873568 9.2 Ssl 1-14:31:43 /usr/sbin/mariadbd 508924 1 netdata 181512 2.0 Ssl 1-14:31:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 167580 0.1 S 53:20 spamd child 1502904 1451906 root 161156 0.0 S 14:14:32 spamd child 254959 510022 madalice 159576 10.2 S 02:25 php-fpm: pool madalice_com_au 270929 256536 customc 133936 24.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270932 270893 customc 133888 49.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270933 270647 customc 133864 64.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270930 264751 customc 133700 52.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270931 270755 customc 133572 52.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270936 254928 customc 133016 56.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1451906 1 root 132000 0.0 Ss 14:27:47 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 270934 270636 customc 127904 49.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270942 254921 customc 120388 42.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270937 270896 customc 109896 37.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 509266 1 root 108488 0.0 Ss 1-14:31:09 /usr/lib/systemd/systemd-journald 270938 270899 customc 107456 40.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270940 270897 customc 98712 33.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270941 270898 customc 95080 35.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270945 270635 customc 90868 29.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270977 236854 customc 73104 18.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 270968 254920 customc 68320 17.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 133529 1353308 cpanellogin 65420 0.0 S 39:12 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 270969 255048 customc 65128 16.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 509236 509098 root 64304 0.0 Sl 1-14:31:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 259961 1353308 infinium 55940 0.2 S 00:50 webmaild - serving 1.41.252.211 1353308 1 root 42424 0.1 Ss 38-14:09:35 cpsrvd (SSL) - waiting for connections 270935 254930 evolution 40528 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 270943 270894 evolution 40324 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 37880 0.0 Sl 1-14:31:07 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33372 0.0 Ss 14:28:40 lfd - sleeping 220778 938407 infinium 31872 0.0 S 10:58 php-fpm: pool user_infinium 510022 1 root 28324 0.0 Ss 1-14:31:05 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-12:38:46 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 24252 0.2 Ssl 1-14:32:26 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 251618 506832 nobody 22872 0.1 S 05:35 /usr/sbin/httpd -k start 254526 506832 nobody 22648 0.0 S 03:24 /usr/sbin/httpd -k start 1469 1 root 22484 0.1 Ss 61-06:41:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 254920 506832 nobody 21728 0.1 S 02:30 /usr/sbin/httpd -k start 236854 506832 nobody 21692 0.0 S 06:50 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-06:41:04 tailwatchd 254928 506832 nobody 20960 0.0 S 02:29 /usr/sbin/httpd -k start 254921 506832 nobody 20688 0.0 S 02:30 /usr/sbin/httpd -k start 270646 506832 nobody 20476 0.0 S 00:33 /usr/sbin/httpd -k start 270755 506832 nobody 20024 0.0 S 00:21 /usr/sbin/httpd -k start 270635 506832 nobody 19792 0.1 S 00:34 /usr/sbin/httpd -k start 255048 506832 nobody 19272 0.0 S 02:17 /usr/sbin/httpd -k start 254930 506832 nobody 19132 0.1 S 02:29 /usr/sbin/httpd -k start 256536 506832 nobody 18884 0.0 S 00:55 /usr/sbin/httpd -k start 264751 506832 nobody 17676 0.0 S 00:47 /usr/sbin/httpd -k start 270647 506832 nobody 17596 0.0 S 00:33 /usr/sbin/httpd -k start 270637 506832 nobody 17452 0.0 S 00:34 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-14:31:17 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 270642 506832 nobody 17348 0.0 S 00:33 /usr/sbin/httpd -k start 270636 506832 nobody 17220 0.0 S 00:34 /usr/sbin/httpd -k start 509671 508992 netdata 17068 2.1 Sl 1-14:31:07 /usr/libexec/netdata/plugins.d/apps.plugin 1 270894 506832 nobody 17012 0.1 S 00:07 /usr/sbin/httpd -k start 270897 506832 nobody 16712 0.0 S 00:06 /usr/sbin/httpd -k start 270898 506832 nobody 16708 0.0 S 00:06 /usr/sbin/httpd -k start 270893 506832 nobody 16676 0.1 S 00:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4105645 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 180 customc/customcentral.com.au-ssl_log 139 coscom/swms.coscom.com.au 133 coscom/coscom.com.au-ssl_log 124 otterfencing/otterfencing.com.au-ssl_log 117 olympic/olympicfencing.com.au-ssl_log 86 evolution/my.evolutionerp.com.au-ssl_log 68 speedlin/speedlinefencing.com.au-ssl_log 61 evolution/portal.evolutionerp.com.au-ssl_log 32 madalice/madalice.com.au-ssl_log 16 alison/alisonarts.com.au-ssl_log 12 infinium/infinium.net.au-ssl_log 8 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 180 20.48.251.3 135 35.243.113.133 133 52.139.44.162 126 52.139.37.240 124 34.26.97.41 117 68.155.159.216 81 20.220.10.235 32 203.54.180.238 9 34.139.71.221 8 118.127.40.55 2 45.61.187.148 2 40.77.167.62 2 200.163.235.240 2 166.114.174.84 2 162.241.63.88 --- top request paths across all vhosts (last 3 min) --- 32 GET /heartbeat.php 11 GET / 7 POST /wp-cron.php 5 GET /store/hand-painted-nike-af1-sunflower/ 4 POST /wp-login.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /wp-blog.php 4 GET /this_is_a_new_hello_world.php 3 GET /wp-login.php 3 GET /wp-content/themes/index.php 3 GET /wp-content/admin.php 3 GET /wp-admin.php 3 GET /wp-admin/maint/index.php 3 GET /wp-admin/css/colors/modern/ 3 GET /ms-edit.php 3 GET /index.php 3 GET /@fs/proc/self/environ 3 GET /file.php 3 GET /chosen.php 3 GET /admin.php --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 2 GET /thui.php 2 GET /ms-edit.php 2 GET /koiy.php 2 GET /cloud.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xmy.php 1 GET /xin1.php -- last 10 requests -- 20.48.251.3 - - [29/Aug/2026:16:49:47 +1000] "GET /cloud.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:47 +1000] "GET /asdf.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:48 +1000] "GET /app/Helpers/bladeHelpers.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:48 +1000] "GET /hochladen.form.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:49 +1000] "GET /debuggen.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:49 +1000] "GET /pouhg.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:50 +1000] "GET /adminfus.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:50 +1000] "GET /avim.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:51 +1000] "GET /nw.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [29/Aug/2026:16:49:51 +1000] "GET /product.php HTTP/1.1" 404 5750 "-" "-" == customc/customcentral.com.au-ssl_log == -- top paths -- 5 GET / 2 POST /wp-cron.php 2 GET /@fs/proc/self/environ 1 GET /web/.env 1 GET /@vite/env 1 GET /v2/.env 1 GET /v1/.env 1 GET /uploads../.env 1 GET /.ssh/id_rsa 1 GET /.ssh/id_ed25519 1 GET /.ssh/id_ecdsa 1 GET /.ssh/id_dsa -- last 10 requests -- 35.243.113.133 - - [29/Aug/2026:16:50:45 +1000] "GET /.kube/config HTTP/1.1" 404 73283 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 35.243.113.133 - - [29/Aug/2026:16:50:45 +1000] "GET /api/env HTTP/1.1" 404 73278 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Slackbot-LinkExpanding/1.0; +https://api. 35.243.113.133 - - [29/Aug/2026:16:50:47 +1000] "GET /.ssh/id_rsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.8611.168 Safari/537.36; compatible; 35.243.113.133 - - [29/Aug/2026:16:50:47 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user" 35.243.113.133 - - [29/Aug/2026:16:50:47 +1000] "GET /.ssh/id_ecdsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 35.243.113.133 - - [29/Aug/2026:16:50:47 +1000] "GET /.ssh/id_dsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 35.243.113.133 - - [29/Aug/2026:16:50:45 +1000] "GET /api/config HTTP/1.1" 404 73281 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.17) Gecko/20100101 Firefox/150.17; compatible; PerplexityBot/1.0; +https://pe 35.243.113.133 - - [29/Aug/2026:16:50:47 +1000] "GET /api/v1/env HTTP/1.1" 404 73282 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 35.243.113.133 - - [29/Aug/2026:16:50:47 +1000] "GET /api/v1/settings HTTP/1.1" 404 73287 "-" "Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 35.243.113.133 - - [29/Aug/2026:16:50:51 +1000] "GET /id_rsa HTTP/1.1" 404 73276 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" == coscom/swms.coscom.com.au == -- top paths -- 2 GET /wp-content/themes/index.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET //wp-includes/Requests/ -- last 10 requests -- 52.139.44.162 - - [29/Aug/2026:16:50:26 +1000] "GET /wp-manager.php HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:26 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:26 +1000] "GET //cgi-bin/admin.php HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:27 +1000] "GET /wp-content/ HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:27 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:27 +1000] "GET //wp-includes/block-bindings/ HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:27 +1000] "GET //wp-includes/assets/ HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:27 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:28 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 404 - "-" "-" 52.139.44.162 - - [29/Aug/2026:16:50:28 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 16:48:32 L1=0.93 run=2 blk=0 avail=8279 (60.1%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=383 ap=26 tcp=27 topuser=madalice 2026-08-29 16:48:33 L1=0.93 run=1 blk=0 avail=8310 (60.3%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=354 ap=25 tcp=28 topuser=madalice 2026-08-29 16:48:42 L1=1.03 run=1 blk=0 avail=8290 (60.2%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=353 ap=26 tcp=29 topuser=madalice 2026-08-29 16:48:43 L1=1.03 run=1 blk=0 avail=8297 (60.2%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=353 ap=25 tcp=28 topuser=madalice 2026-08-29 16:48:52 L1=0.87 run=2 blk=0 avail=8346 (60.6%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=352 ap=19 tcp=28 topuser=madalice 2026-08-29 16:48:53 L1=0.87 run=2 blk=0 avail=8290 (60.2%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=420 ap=19 tcp=28 topuser=madalice 2026-08-29 16:49:02 L1=0.74 run=2 blk=0 avail=8170 (59.3%) swpO=0 conn=3 myRSS=2806 php=6 phpRSS=589 ap=18 tcp=33 topuser=madalice 2026-08-29 16:49:03 L1=0.74 run=1 blk=0 avail=8368 (60.7%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=353 ap=18 tcp=30 topuser=madalice 2026-08-29 16:49:12 L1=0.93 run=1 blk=0 avail=8337 (60.5%) swpO=0 conn=3 myRSS=2806 php=5 phpRSS=377 ap=19 tcp=31 topuser=madalice 2026-08-29 16:49:13 L1=0.93 run=4 blk=0 avail=8233 (59.8%) swpO=0 conn=1 myRSS=2806 php=5 phpRSS=489 ap=19 tcp=32 topuser=madalice 2026-08-29 16:49:22 L1=0.87 run=4 blk=0 avail=8131 (59.0%) swpO=0 conn=3 myRSS=2806 php=6 phpRSS=621 ap=19 tcp=36 topuser=madalice 2026-08-29 16:49:23 L1=0.87 run=5 blk=0 avail=8040 (58.4%) swpO=2 conn=1 myRSS=2806 php=7 phpRSS=748 ap=19 tcp=35 topuser=madalice 2026-08-29 16:49:32 L1=0.97 run=1 blk=0 avail=8254 (59.9%) swpO=2 conn=3 myRSS=2806 php=4 phpRSS=354 ap=21 tcp=32 topuser=madalice 2026-08-29 16:49:33 L1=0.97 run=2 blk=0 avail=8248 (59.9%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=354 ap=21 tcp=34 topuser=madalice 2026-08-29 16:49:42 L1=0.97 run=9 blk=0 avail=8249 (59.9%) swpO=0 conn=3 myRSS=2806 php=4 phpRSS=358 ap=22 tcp=30 topuser=madalice 2026-08-29 16:49:43 L1=0.97 run=3 blk=0 avail=8181 (59.4%) swpO=0 conn=1 myRSS=2806 php=4 phpRSS=352 ap=22 tcp=33 topuser=madalice 2026-08-29 16:49:52 L1=0.98 run=3 blk=0 avail=8117 (58.9%) swpO=0 conn=3 myRSS=2806 php=6 phpRSS=559 ap=22 tcp=33 topuser=madalice 2026-08-29 16:49:53 L1=0.98 run=7 blk=0 avail=8108 (58.8%) swpO=0 conn=1 myRSS=2806 php=7 phpRSS=459 ap=22 tcp=34 topuser=madalice 2026-08-29 16:50:02 L1=1.15 run=3 blk=0 avail=8156 (59.2%) swpO=0 conn=2 myRSS=2806 php=5 phpRSS=477 ap=23 tcp=33 topuser=madalice 2026-08-29 16:50:03 L1=1.15 run=2 blk=0 avail=8250 (59.9%) swpO=0 conn=1 myRSS=2806 php=5 phpRSS=394 ap=23 tcp=34 topuser=madalice 2026-08-29 16:50:12 L1=1.43 run=5 blk=0 avail=7709 (56.0%) swpO=0 conn=2 myRSS=2806 php=8 phpRSS=965 ap=30 tcp=56 topuser=customc 2026-08-29 16:50:13 L1=1.43 run=2 blk=0 avail=8192 (59.5%) swpO=0 conn=1 myRSS=2806 php=5 phpRSS=394 ap=30 tcp=42 topuser=madalice 2026-08-29 16:50:23 L1=2.09 run=1 blk=0 avail=8127 (59.0%) swpO=0 conn=2 myRSS=2806 php=4 phpRSS=355 ap=44 tcp=30 topuser=madalice 2026-08-29 16:50:23 L1=2.09 run=1 blk=0 avail=8120 (58.9%) swpO=0 conn=1 myRSS=2806 php=5 phpRSS=395 ap=43 tcp=31 topuser=madalice 2026-08-29 16:50:33 L1=2.07 run=2 blk=0 avail=8168 (59.3%) swpO=0 conn=2 myRSS=2806 php=5 phpRSS=416 ap=34 tcp=58 topuser=madalice 2026-08-29 16:50:33 L1=2.07 run=12 blk=0 avail=7286 (52.9%) swpO=0 conn=1 myRSS=2806 php=12 phpRSS=1428 ap=34 tcp=54 topuser=customc 2026-08-29 16:50:43 L1=1.82 run=1 blk=0 avail=8250 (59.9%) swpO=0 conn=2 myRSS=2806 php=4 phpRSS=355 ap=27 tcp=21 topuser=madalice 2026-08-29 16:50:44 L1=1.82 run=1 blk=0 avail=8231 (59.7%) swpO=0 conn=3 myRSS=2806 php=6 phpRSS=436 ap=26 tcp=23 topuser=madalice 2026-08-29 16:50:53 L1=1.70 run=3 blk=0 avail=8139 (59.1%) swpO=0 conn=2 myRSS=2806 php=6 phpRSS=532 ap=27 tcp=25 topuser=madalice 2026-08-29 16:50:54 L1=1.70 run=17 blk=0 avail=7371 (53.5%) swpO=0 conn=16 myRSS=2806 php=19 phpRSS=1686 ap=26 tcp=46 topuser=customc