INCIDENT 2026-08-29 20:09:06 trigger: php_procs=26 mysql_conn=15 ================================================================== load: 4.69 2.37 1.55 27/683 955017 ncpu:10 mem_avail: 7798MB/13777MB (56.6%) swap_used:1502MB swapout:0/s blocked(D):0 running:32 iowait:0.4% steal:0.0% php: 26 procs / 1443MB heaviest user: vinesit (22 procs, 1226MB) apache: 34 procs tcp_estab: 65 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2802 vinesit 23 1389 root 252 1064 nobody 34 609 netdata 7 200 mailman 20 189 madalice 1 132 cpanellogin 1 64 dovenull 6 56 tubesupplies 1 48 wp-toolkit 3 43 aaa 3 43 evolution 7 27 zabbix 1 23 dovecot 3 22 mailnull 2 19 named 1 16 kurri 1 13 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB vinesit 23 1437 madalice 1 132 tubesupplies 1 48 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5502 MB Active(file): 4441 MB Inactive(file): 1243 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 595 MB CommitLimit: 10984 MB Committed_AS: 10784 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-17:50:26 7112 /usr/bin/imunify-agent-proxy 918153 root 09:06 1332 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2869492 8.8 Ssl 1-17:49:55 /usr/sbin/mariadbd 508924 1 netdata 179812 1.9 Ssl 1-17:49:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 175184 0.0 S 04:11:32 spamd child 1502904 1451906 root 168960 0.0 S 17:32:44 spamd child 954892 510022 madalice 136080 17.2 S 00:08 php-fpm: pool madalice_com_au 1451906 1 root 130016 0.0 Ss 17:45:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 115000 0.0 Ss 1-17:49:21 /usr/lib/systemd/systemd-journald 954961 954556 vinesit 94156 84.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954977 954521 vinesit 93084 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954971 934657 vinesit 92008 73.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954960 954566 vinesit 87924 60.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954970 935039 vinesit 85812 58.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954969 952200 vinesit 74128 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954964 932715 vinesit 71352 42.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954965 954513 vinesit 70920 42.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954963 954567 vinesit 70128 35.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954980 935142 vinesit 69748 34.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954972 954558 vinesit 68916 36.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954966 954571 vinesit 68160 35.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954967 954519 vinesit 67876 28.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954978 954511 vinesit 67440 27.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954976 952818 vinesit 67392 27.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954975 954561 vinesit 67132 28.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954968 935038 vinesit 66640 28.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 843132 1353308 cpanellogin 65800 0.0 S 32:20 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 954962 954795 vinesit 65256 29.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 63320 0.0 Sl 1-17:49:21 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 954973 954514 vinesit 62268 26.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954982 954560 vinesit 62260 21.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954974 954348 vinesit 61952 25.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 955011 955004 vinesit 60700 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954981 935151 vinesit 60428 19.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 954983 935153 tubesupplies 55344 19.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42708 0.1 Ss 38-17:27:47 cpsrvd (SSL) - waiting for connections 509640 508992 root 39968 0.0 Sl 1-17:49:19 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33324 0.0 Ss 17:46:52 lfd - sleeping 510022 1 root 28308 0.0 Ss 1-17:49:17 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25572 0.0 Ss 1-15:56:58 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 935142 506832 nobody 23476 0.0 S 05:08 /usr/sbin/httpd -k start 483898 1 zabbix 23136 0.2 Ssl 1-17:50:38 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 935151 506832 nobody 22936 0.2 S 05:08 /usr/sbin/httpd -k start 932715 506832 nobody 22804 0.1 S 08:30 /usr/sbin/httpd -k start 934657 506832 nobody 22676 0.0 S 05:49 /usr/sbin/httpd -k start 1469 1 root 22484 0.1 Ss 61-09:59:16 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 935038 506832 nobody 22012 0.0 S 05:10 /usr/sbin/httpd -k start 951997 506832 nobody 21472 0.0 S 02:17 /usr/sbin/httpd -k start 1463 1 root 21380 0.0 Ss 61-09:59:16 tailwatchd 954511 506832 nobody 20748 0.1 S 00:36 /usr/sbin/httpd -k start 952818 506832 nobody 19896 0.0 S 01:44 /usr/sbin/httpd -k start 935153 506832 nobody 19876 0.1 S 05:08 /usr/sbin/httpd -k start 954348 506832 nobody 19860 0.0 S 00:49 /usr/sbin/httpd -k start 954558 506832 nobody 19620 0.0 S 00:34 /usr/sbin/httpd -k start 952200 506832 nobody 19556 0.0 S 02:01 /usr/sbin/httpd -k start 954513 506832 nobody 19452 0.1 S 00:36 /usr/sbin/httpd -k start 954519 506832 nobody 18660 0.0 S 00:35 /usr/sbin/httpd -k start 954514 506832 nobody 18620 0.0 S 00:36 /usr/sbin/httpd -k start 952896 506832 nobody 18604 0.0 S 01:42 /usr/sbin/httpd -k start 954571 506832 nobody 18528 0.0 S 00:34 /usr/sbin/httpd -k start 954562 506832 nobody 18488 0.0 S 00:34 /usr/sbin/httpd -k start 954979 954525 nobody 18452 6.0 S 00:01 /usr/local/cpanel/cgi-sys/autodiscover.cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------------+------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------------+------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4171191 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4171168 | vinesit_wp | vinesit_wp | Query | 0 | Sending data | SHOW FULL COLUMNS FROM `7EykARYhU_wflivetraffichuman` | +---------+------------+------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 923 vinesit/vinesit.com.au-ssl_log 188 lowrange/lowrange.com.au-ssl_log 171 tubesupplies/tubesupplies.com.au-ssl_log 47 tubesupplies/tubesupplies.com.au 42 evolution/portal.evolutionerp.com.au-ssl_log 22 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 818 93.123.109.228 181 34.146.229.191 171 20.100.175.163 83 20.48.160.90 68 52.139.37.240 37 20.63.81.20 22 203.54.180.238 9 118.127.40.55 2 9.206.0.191 1 180.243.120.4 1 17.166.25.67 1 17.166.22.210 1 152.59.201.139 1 125.165.166.137 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 37 GET /autodiscover/autodiscover.xml 22 GET /heartbeat.php 14 GET / 7 POST / 4 GET /login 4 GET /.git-credentials 4 GET /@fs/proc/self/environ 3 POST /wp-cron.php 3 GET /php.php 3 GET /.git/HEAD 3 GET /.git/config 3 GET /.env.swp 3 GET /.env.old 3 GET /.env.bak 3 GET /.env 3 GET /contact 3 GET /config.php 3 GET /app/.env 3 GET /404.shtml 3 GET /222.php --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 37 GET /autodiscover/autodiscover.xml 6 GET / 4 GET /login 3 GET /404.shtml 2 GET /wp_mail_smtp.ini 2 GET /wp-json/wp/v2/users 2 GET /wp-json/gravitysmtp/v1/tests/mock-data 2 GET /wp-content/mysql.sql 2 GET /wp-content/debug.log 2 GET /.wp-config.php.swp 2 GET /.well-known/stripe.txt 2 GET /.well-known/stripe/ -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:20:08:51 +1000] "GET /disagreed.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.81.20 - - [29/Aug/2026:20:08:51 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.37.240 - - [29/Aug/2026:20:08:51 +1000] "GET /kyami.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:08:51 +1000] "GET /DxHhVcy2bmJ.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:08:52 +1000] "GET /amaxx.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:08:52 +1000] "GET /BIBIL0DAY.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:08:52 +1000] "GET /functions.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.81.20 - - [29/Aug/2026:20:08:52 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.37.240 - - [29/Aug/2026:20:08:52 +1000] "GET /wp-comments-post.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:08:52 +1000] "GET /conf_upload.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == vinesit/vinesit.com.au-ssl_log == -- top paths -- 6 POST / 6 GET / 4 GET /@fs/proc/self/environ 2 GET /@vite/env 2 GET /.github/.env 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.git/config 2 GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token 2 GET /@fs/root/.vultr-cli.yaml 2 GET /@fs/root/terraform.tfstate 2 GET /@fs/root/rootkey.csv -- last 10 requests -- 34.146.229.191 - - [29/Aug/2026:20:09:05 +1000] "GET /api/settings HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.146.229.191 - - [29/Aug/2026:20:09:07 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.8) Gecko/20100101 Firefox/121.8; compatible; Discordbot/2.0; +https://disco 34.146.229.191 - - [29/Aug/2026:20:09:07 +1000] "GET /.ssh/id_rsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; GPTBot/1.2; +https://openai.com/gptbot)" 34.146.229.191 - - [29/Aug/2026:20:09:07 +1000] "GET /.ssh/id_ecdsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.14) Gecko/20100101 Firefox/121.14; compatible; GPTBot/1.2; +https://openai.com/gp 34.146.229.191 - - [29/Aug/2026:20:09:07 +1000] "GET /.ssh/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Twitterbot/1.0)" 34.146.229.191 - - [29/Aug/2026:20:09:06 +1000] "GET /api/v1/settings HTTP/1.1" 301 - "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +htt 34.146.229.191 - - [29/Aug/2026:20:09:05 +1000] "GET /api/config HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; TelegramBot/1.0)" 34.146.229.191 - - [29/Aug/2026:20:09:05 +1000] "GET /api/v1/config HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; LinkedInBot/1.0; +http://www.linkedin.com" 34.146.229.191 - - [29/Aug/2026:20:09:05 +1000] "GET /api/env HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Applebot/0.1; +http://www.apple.com/go/applebot" 34.146.229.191 - - [29/Aug/2026:20:09:06 +1000] "GET /api/v1/env HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; WhatsApp/10.0.2.1)" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.100.175.163 - - [29/Aug/2026:20:08:31 +1000] "GET /404.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:31 +1000] "GET /php.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:32 +1000] "GET /init.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:32 +1000] "GET /wp-includes/js/codemirror/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 20.100.175.163 - - [29/Aug/2026:20:08:32 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:33 +1000] "GET /wp-includes/Requests/library/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:33 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:33 +1000] "GET /wp-configs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:33 +1000] "GET /wp-includes/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:20:08:34 +1000] "GET /wp-admin/a.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 20:06:45 L1=1.47 run=6 blk=0 avail=8339 (60.5%) swpO=0 conn=1 myRSS=2802 php=4 phpRSS=332 ap=16 tcp=31 topuser=madalice 2026-08-29 20:06:45 L1=1.47 run=3 blk=0 avail=8435 (61.2%) swpO=0 conn=2 myRSS=2802 php=3 phpRSS=201 ap=16 tcp=31 topuser=madalice 2026-08-29 20:06:55 L1=1.55 run=2 blk=0 avail=8277 (60.1%) swpO=0 conn=1 myRSS=2802 php=4 phpRSS=369 ap=17 tcp=32 topuser=madalice 2026-08-29 20:06:55 L1=1.55 run=2 blk=0 avail=8221 (59.7%) swpO=0 conn=2 myRSS=2802 php=4 phpRSS=422 ap=17 tcp=31 topuser=madalice 2026-08-29 20:07:05 L1=1.39 run=3 blk=0 avail=8302 (60.3%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=374 ap=20 tcp=35 topuser=madalice 2026-08-29 20:07:05 L1=1.39 run=3 blk=0 avail=8205 (59.6%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=470 ap=20 tcp=35 topuser=madalice 2026-08-29 20:07:15 L1=1.25 run=2 blk=0 avail=8120 (58.9%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=420 ap=39 tcp=49 topuser=madalice 2026-08-29 20:07:15 L1=1.25 run=3 blk=0 avail=8086 (58.7%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=451 ap=39 tcp=51 topuser=madalice 2026-08-29 20:07:25 L1=1.52 run=2 blk=0 avail=7905 (57.4%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=449 ap=66 tcp=72 topuser=madalice 2026-08-29 20:07:26 L1=1.52 run=2 blk=0 avail=7869 (57.1%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=485 ap=66 tcp=73 topuser=madalice 2026-08-29 20:07:35 L1=1.52 run=3 blk=0 avail=7847 (57.0%) swpO=0 conn=2 myRSS=2802 php=6 phpRSS=628 ap=59 tcp=57 topuser=madalice 2026-08-29 20:07:36 L1=1.52 run=7 blk=0 avail=8056 (58.5%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=392 ap=59 tcp=55 topuser=madalice 2026-08-29 20:07:45 L1=1.74 run=6 blk=0 avail=7885 (57.2%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=623 ap=49 tcp=57 topuser=madalice 2026-08-29 20:07:46 L1=1.74 run=3 blk=0 avail=8061 (58.5%) swpO=0 conn=3 myRSS=2802 php=5 phpRSS=446 ap=49 tcp=57 topuser=madalice 2026-08-29 20:07:55 L1=1.63 run=2 blk=0 avail=8142 (59.1%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=419 ap=44 tcp=27 topuser=madalice 2026-08-29 20:07:56 L1=1.63 run=2 blk=0 avail=8107 (58.8%) swpO=0 conn=3 myRSS=2802 php=5 phpRSS=454 ap=44 tcp=27 topuser=madalice 2026-08-29 20:08:05 L1=1.53 run=3 blk=0 avail=8132 (59.0%) swpO=0 conn=3 myRSS=2802 php=6 phpRSS=522 ap=34 tcp=27 topuser=madalice 2026-08-29 20:08:06 L1=1.53 run=3 blk=0 avail=8061 (58.5%) swpO=0 conn=3 myRSS=2802 php=6 phpRSS=595 ap=33 tcp=26 topuser=madalice 2026-08-29 20:08:15 L1=2.40 run=2 blk=0 avail=8139 (59.1%) swpO=0 conn=3 myRSS=2802 php=5 phpRSS=472 ap=34 tcp=40 topuser=madalice 2026-08-29 20:08:16 L1=2.40 run=3 blk=0 avail=8188 (59.4%) swpO=0 conn=3 myRSS=2802 php=5 phpRSS=427 ap=34 tcp=39 topuser=madalice 2026-08-29 20:08:25 L1=2.34 run=2 blk=0 avail=8293 (60.2%) swpO=0 conn=3 myRSS=2802 php=4 phpRSS=326 ap=31 tcp=33 topuser=madalice 2026-08-29 20:08:26 L1=2.34 run=1 blk=0 avail=8397 (61.0%) swpO=0 conn=3 myRSS=2802 php=3 phpRSS=198 ap=30 tcp=32 topuser=madalice 2026-08-29 20:08:36 L1=5.64 run=22 blk=0 avail=8083 (58.7%) swpO=0 conn=3 myRSS=2802 php=8 phpRSS=486 ap=57 tcp=41 topuser=vinesit 2026-08-29 20:08:36 L1=5.64 run=7 blk=0 avail=7995 (58.0%) swpO=0 conn=3 myRSS=2802 php=7 phpRSS=551 ap=56 tcp=42 topuser=vinesit 2026-08-29 20:08:46 L1=4.77 run=2 blk=0 avail=8223 (59.7%) swpO=0 conn=3 myRSS=2802 php=4 phpRSS=289 ap=47 tcp=32 topuser=madalice 2026-08-29 20:08:46 L1=4.77 run=2 blk=0 avail=8193 (59.5%) swpO=0 conn=2 myRSS=2802 php=4 phpRSS=325 ap=46 tcp=30 topuser=madalice 2026-08-29 20:08:56 L1=4.12 run=4 blk=0 avail=8208 (59.6%) swpO=0 conn=3 myRSS=2802 php=5 phpRSS=375 ap=42 tcp=31 topuser=madalice 2026-08-29 20:08:56 L1=4.12 run=2 blk=0 avail=8123 (59.0%) swpO=0 conn=2 myRSS=2802 php=5 phpRSS=345 ap=41 tcp=32 topuser=madalice 2026-08-29 20:09:06 L1=4.69 run=32 blk=0 avail=7798 (56.6%) swpO=0 conn=15 myRSS=2802 php=26 phpRSS=1443 ap=34 tcp=65 topuser=vinesit 2026-08-29 20:09:06 L1=4.69 run=33 blk=0 avail=7571 (55.0%) swpO=0 conn=23 myRSS=2802 php=27 phpRSS=1740 ap=34 tcp=65 topuser=vinesit