INCIDENT 2026-08-29 20:19:30 trigger: php_rss=1780MB ================================================================== load: 1.91 1.33 1.38 6/675 992410 ncpu:10 mem_avail: 6893MB/13777MB (50.0%) swap_used:1502MB swapout:0/s blocked(D):0 running:8 iowait:0.0% steal:0.0% php: 12 procs / 1780MB heaviest user: madalice (10 procs, 1738MB) apache: 41 procs tcp_estab: 59 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2807 madalice 10 1698 root 252 1120 nobody 40 716 netdata 7 200 mailman 20 189 cpanellogin 1 66 dovenull 6 56 wp-toolkit 3 43 candyfabcom 2 28 evolution 7 27 zabbix 1 22 dovecot 3 22 mailnull 2 20 named 1 16 aaa 1 14 kurri 1 13 polkitd 1 6 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1703 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5139 MB Active(file): 4458 MB Inactive(file): 1247 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 595 MB CommitLimit: 10984 MB Committed_AS: 8715 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-18:00:49 7376 /usr/bin/imunify-agent-proxy 991272 root 01:59 58748 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2875168 8.8 Ssl 1-18:00:18 /usr/sbin/mariadbd 992283 510022 madalice 232928 50.3 R 00:15 php-fpm: pool madalice_com_au 992290 510022 madalice 231404 58.0 R 00:11 php-fpm: pool madalice_com_au 992294 510022 madalice 188600 62.0 S 00:10 php-fpm: pool madalice_com_au 508924 1 netdata 179576 1.9 Ssl 1-17:59:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 175188 0.0 S 04:21:55 spamd child 1502904 1451906 root 168952 0.0 S 17:43:07 spamd child 992369 510022 madalice 166388 85.7 R 00:04 php-fpm: pool madalice_com_au 992288 510022 madalice 164188 58.9 R 00:11 php-fpm: pool madalice_com_au 992368 510022 madalice 159416 88.2 S 00:04 php-fpm: pool madalice_com_au 992289 510022 madalice 159268 65.1 S 00:11 php-fpm: pool madalice_com_au 992291 510022 madalice 159240 57.0 S 00:11 php-fpm: pool madalice_com_au 992370 510022 madalice 159124 92.2 S 00:04 php-fpm: pool madalice_com_au 992295 510022 madalice 159032 61.9 S 00:10 php-fpm: pool madalice_com_au 1451906 1 root 129928 0.0 Ss 17:56:22 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 115264 0.0 Ss 1-17:59:44 /usr/lib/systemd/systemd-journald 843132 1353308 cpanellogin 67656 0.0 S 42:43 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 509236 509098 root 63392 0.0 Sl 1-17:59:44 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 991272 1 root 58748 1.5 Ssl 01:59 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 42760 0.1 Ss 38-17:38:10 cpsrvd (SSL) - waiting for connections 509640 508992 root 40232 0.0 Sl 1-17:59:42 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33328 0.0 Ss 17:57:15 lfd - sleeping 510022 1 root 28308 0.0 Ss 1-17:59:40 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25572 0.0 Ss 1-16:07:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 971527 506832 nobody 23936 0.0 S 07:13 /usr/sbin/httpd -k start 483898 1 zabbix 23340 0.2 Ssl 1-18:01:01 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 22488 0.1 Ss 61-10:09:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 989934 506832 nobody 22328 0.1 S 03:35 /usr/sbin/httpd -k start 989912 506832 nobody 22212 0.0 S 03:36 /usr/sbin/httpd -k start 974342 506832 nobody 21424 0.1 S 05:16 /usr/sbin/httpd -k start 1463 1 root 21380 0.0 Ss 61-10:09:39 tailwatchd 991438 506832 nobody 21172 0.0 S 01:44 /usr/sbin/httpd -k start 992321 506832 nobody 20428 0.3 S 00:09 /usr/sbin/httpd -k start 992323 506832 nobody 20380 0.3 S 00:08 /usr/sbin/httpd -k start 992322 506832 nobody 20372 0.2 S 00:09 /usr/sbin/httpd -k start 989935 506832 nobody 20332 0.0 S 03:35 /usr/sbin/httpd -k start 992293 506832 nobody 20256 0.3 S 00:10 /usr/sbin/httpd -k start 992324 506832 nobody 20256 0.2 S 00:08 /usr/sbin/httpd -k start 991450 506832 nobody 20220 0.0 S 01:42 /usr/sbin/httpd -k start 991444 506832 nobody 20120 0.0 S 01:43 /usr/sbin/httpd -k start 991442 506832 nobody 19692 0.0 S 01:43 /usr/sbin/httpd -k start 991451 506832 nobody 19656 0.0 S 01:42 /usr/sbin/httpd -k start 991441 506832 nobody 19460 0.0 S 01:43 /usr/sbin/httpd -k start 992353 506832 nobody 19380 0.2 S 00:07 /usr/sbin/httpd -k start 991453 506832 nobody 19292 0.0 S 01:42 /usr/sbin/httpd -k start 992376 506832 nobody 19276 0.6 S 00:03 /usr/sbin/httpd -k start 992380 506832 nobody 19276 0.5 S 00:02 /usr/sbin/httpd -k start 992379 506832 nobody 19216 0.5 S 00:02 /usr/sbin/httpd -k start 992378 506832 nobody 19188 0.5 S 00:02 /usr/sbin/httpd -k start 992325 506832 nobody 19156 0.2 S 00:08 /usr/sbin/httpd -k start 991452 506832 nobody 18492 0.0 S 01:42 /usr/sbin/httpd -k start 992354 506832 nobody 17908 0.0 S 00:07 /usr/sbin/httpd -k start 992226 506832 nobody 17852 0.0 S 00:20 /usr/sbin/httpd -k start 992351 506832 nobody 17776 0.0 S 00:07 /usr/sbin/httpd -k start 992352 506832 nobody 17776 0.0 S 00:07 /usr/sbin/httpd -k start 508634 1 named 17396 0.0 Ssl 1-17:59:52 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 992326 506832 nobody 17360 0.0 S 00:08 /usr/sbin/httpd -k start 509671 508992 netdata 17048 2.1 Sl 1-17:59:42 /usr/libexec/netdata/plugins.d/apps.plugin 1 992367 506832 nobody 16812 0.0 S 00:04 /usr/sbin/httpd -k start 992355 506832 nobody 16752 0.0 S 00:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4174717 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au-ssl_log 59 otterfencing/otterfencing.com.au-ssl_log 57 madalice/madalice.com.au-ssl_log 31 evolution/portal.evolutionerp.com.au-ssl_log 20 corpkicks/corporatekicks.com.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 2 tubesupplies/tubesupplies.com.au-ssl_log 2 alison/alisonarts.com.au 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 116 52.139.37.240 22 35.231.130.18 20 203.54.180.238 3 114.119.131.88 2 118.127.40.55 1 43.173.181.235 1 43.173.180.47 1 43.173.177.83 1 43.172.196.121 1 43.172.194.74 1 34.196.51.17 1 2a03:2880:f802:2a:: 1 207.46.13.7 1 137.131.21.78 1 119.28.140.106 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 7 GET / 2 POST /wp-cron.php 2 GET /zup.php 2 GET /z.php 2 GET /zafir1.php 2 GET /xxx.php 2 GET /xmrlpc.php 2 GET /ws49.php 2 GET /wp-wordfence-waf.php 2 GET /wp-update.php 2 GET /wp-info.php 2 GET /wp-includes/Text/Diff/Engine/ 2 GET /wp-includes/interactivity-api/index.php 2 GET /wp-includes/images/media/ 2 GET /wp-header-json.php 2 GET /wp-content/uploads/admin.php 2 GET /wp-content/themes/x/bypass.php 2 GET /wp-content/themes/min.php 2 GET /wp-content/plugins/linkpreview/il.php --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-info.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/interactivity-api/index.php 1 GET /wp-includes/images/media/ -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:20:18:26 +1000] "GET /vendor/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:26 +1000] "GET /wp-content/plugins/ftde.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:26 +1000] "GET /wp-content/uploads/admin.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:27 +1000] "GET /wp-includes/Text/Diff/Engine/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:27 +1000] "GET /z.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:27 +1000] "GET /f35.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:27 +1000] "GET /file61.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:27 +1000] "GET /mah.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:28 +1000] "GET /mini.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:28 +1000] "GET /v.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-info.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/interactivity-api/index.php 1 GET /wp-includes/images/media/ -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:20:18:13 +1000] "GET /s.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:13 +1000] "GET /sagax.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:13 +1000] "GET /vendor/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:13 +1000] "GET /wp-content/plugins/ftde.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:14 +1000] "GET /wp-content/uploads/admin.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:14 +1000] "GET /wp-includes/Text/Diff/Engine/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:14 +1000] "GET /z.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:14 +1000] "GET /f35.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:14 +1000] "GET /file61.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:20:18:15 +1000] "GET /mah.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET / 2 GET /users/login 2 GET /sign-in 2 GET /secure 2 GET /login 2 GET /forgot-password 2 GET /auth/login 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /user/login 1 GET /tag/flowes/ -- last 10 requests -- 35.231.130.18 - - [29/Aug/2026:20:19:25 +1000] "GET /user/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:20:19:25 +1000] "GET /register HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:20:19:25 +1000] "GET /account/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:20:19:25 +1000] "GET /signup HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:20:19:27 +1000] "GET /login HTTP/1.1" 302 1 "https://www.madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537 35.231.130.18 - - [29/Aug/2026:20:19:27 +1000] "GET /sign-in HTTP/1.1" 404 36641 "https://www.madalice.com.au/sign-in" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Sa 35.231.130.18 - - [29/Aug/2026:20:19:27 +1000] "GET /auth/login HTTP/1.1" 404 36645 "https://www.madalice.com.au/auth/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mob 35.231.130.18 - - [29/Aug/2026:20:19:27 +1000] "GET /users/login HTTP/1.1" 404 36645 "https://www.madalice.com.au/users/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 M 35.231.130.18 - - [29/Aug/2026:20:19:27 +1000] "GET /secure HTTP/1.1" 404 36641 "https://www.madalice.com.au/secure" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.130.18 - - [29/Aug/2026:20:19:27 +1000] "GET /forgot-password HTTP/1.1" 404 36644 "https://www.madalice.com.au/forgot-password" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149 --- last 30 samples (run-up to this incident) --- 2026-08-29 20:17:01 L1=1.30 run=1 blk=0 avail=8672 (62.9%) swpO=0 conn=1 myRSS=2802 php=2 phpRSS=41 ap=14 tcp=19 topuser=root 2026-08-29 20:17:09 L1=1.17 run=3 blk=0 avail=8535 (62.0%) swpO=0 conn=1 myRSS=2802 php=4 phpRSS=226 ap=14 tcp=25 topuser=madalice 2026-08-29 20:17:11 L1=1.17 run=2 blk=0 avail=8181 (59.4%) swpO=0 conn=3 myRSS=2802 php=5 phpRSS=608 ap=14 tcp=26 topuser=corpkicks 2026-08-29 20:17:19 L1=0.99 run=3 blk=0 avail=8555 (62.1%) swpO=0 conn=1 myRSS=2802 php=3 phpRSS=174 ap=14 tcp=26 topuser=madalice 2026-08-29 20:17:21 L1=0.99 run=1 blk=0 avail=8557 (62.1%) swpO=0 conn=3 myRSS=2802 php=3 phpRSS=174 ap=14 tcp=22 topuser=madalice 2026-08-29 20:17:29 L1=0.84 run=1 blk=0 avail=8519 (61.8%) swpO=0 conn=1 myRSS=2802 php=3 phpRSS=174 ap=14 tcp=26 topuser=madalice 2026-08-29 20:17:31 L1=0.84 run=2 blk=0 avail=8121 (59.0%) swpO=0 conn=3 myRSS=2802 php=5 phpRSS=554 ap=14 tcp=26 topuser=corpkicks 2026-08-29 20:17:39 L1=0.86 run=1 blk=0 avail=8431 (61.2%) swpO=0 conn=1 myRSS=2802 php=3 phpRSS=174 ap=15 tcp=23 topuser=madalice 2026-08-29 20:17:41 L1=0.86 run=2 blk=0 avail=8431 (61.2%) swpO=0 conn=3 myRSS=2802 php=3 phpRSS=174 ap=15 tcp=23 topuser=madalice 2026-08-29 20:17:49 L1=0.80 run=4 blk=0 avail=8255 (59.9%) swpO=0 conn=2 myRSS=2807 php=3 phpRSS=268 ap=30 tcp=38 topuser=madalice 2026-08-29 20:17:51 L1=0.80 run=1 blk=0 avail=8377 (60.8%) swpO=0 conn=3 myRSS=2807 php=3 phpRSS=195 ap=29 tcp=25 topuser=madalice 2026-08-29 20:17:59 L1=0.75 run=2 blk=0 avail=8317 (60.4%) swpO=0 conn=2 myRSS=2807 php=4 phpRSS=347 ap=21 tcp=24 topuser=madalice 2026-08-29 20:18:01 L1=0.75 run=1 blk=0 avail=8438 (61.2%) swpO=0 conn=3 myRSS=2807 php=3 phpRSS=196 ap=20 tcp=22 topuser=madalice 2026-08-29 20:18:09 L1=0.64 run=1 blk=0 avail=8427 (61.2%) swpO=0 conn=2 myRSS=2807 php=3 phpRSS=197 ap=19 tcp=27 topuser=madalice 2026-08-29 20:18:11 L1=0.64 run=1 blk=0 avail=8438 (61.2%) swpO=0 conn=1 myRSS=2807 php=3 phpRSS=197 ap=19 tcp=24 topuser=madalice 2026-08-29 20:18:19 L1=0.61 run=2 blk=0 avail=8421 (61.1%) swpO=0 conn=2 myRSS=2807 php=3 phpRSS=197 ap=19 tcp=29 topuser=madalice 2026-08-29 20:18:21 L1=0.61 run=2 blk=0 avail=8379 (60.8%) swpO=0 conn=1 myRSS=2807 php=4 phpRSS=275 ap=19 tcp=28 topuser=madalice 2026-08-29 20:18:29 L1=0.60 run=1 blk=0 avail=8433 (61.2%) swpO=0 conn=2 myRSS=2807 php=3 phpRSS=197 ap=18 tcp=28 topuser=madalice 2026-08-29 20:18:31 L1=0.60 run=1 blk=0 avail=8428 (61.2%) swpO=0 conn=1 myRSS=2807 php=3 phpRSS=197 ap=18 tcp=26 topuser=madalice 2026-08-29 20:18:39 L1=0.59 run=2 blk=0 avail=8518 (61.8%) swpO=0 conn=2 myRSS=2807 php=2 phpRSS=41 ap=18 tcp=29 topuser=root 2026-08-29 20:18:41 L1=0.59 run=2 blk=0 avail=8500 (61.7%) swpO=0 conn=1 myRSS=2807 php=3 phpRSS=152 ap=18 tcp=30 topuser=infinium 2026-08-29 20:18:49 L1=0.65 run=2 blk=0 avail=8264 (60.0%) swpO=0 conn=3 myRSS=2807 php=5 phpRSS=443 ap=18 tcp=24 topuser=evolution 2026-08-29 20:18:51 L1=0.65 run=1 blk=0 avail=8478 (61.5%) swpO=0 conn=1 myRSS=2807 php=3 phpRSS=174 ap=18 tcp=21 topuser=madalice 2026-08-29 20:18:59 L1=0.55 run=1 blk=0 avail=8490 (61.6%) swpO=0 conn=3 myRSS=2807 php=3 phpRSS=174 ap=16 tcp=22 topuser=madalice 2026-08-29 20:19:01 L1=0.55 run=1 blk=0 avail=8490 (61.6%) swpO=0 conn=1 myRSS=2807 php=3 phpRSS=174 ap=16 tcp=21 topuser=madalice 2026-08-29 20:19:09 L1=0.54 run=2 blk=0 avail=8228 (59.7%) swpO=0 conn=3 myRSS=2807 php=4 phpRSS=457 ap=19 tcp=27 topuser=corpkicks 2026-08-29 20:19:11 L1=0.54 run=1 blk=0 avail=8423 (61.1%) swpO=0 conn=2 myRSS=2807 php=3 phpRSS=232 ap=19 tcp=23 topuser=evolution 2026-08-29 20:19:19 L1=0.69 run=9 blk=0 avail=7549 (54.8%) swpO=0 conn=3 myRSS=2807 php=10 phpRSS=1244 ap=19 tcp=35 topuser=madalice 2026-08-29 20:19:21 L1=0.69 run=8 blk=0 avail=7463 (54.2%) swpO=0 conn=2 myRSS=2807 php=9 phpRSS=1266 ap=25 tcp=40 topuser=madalice 2026-08-29 20:19:30 L1=1.91 run=8 blk=0 avail=6893 (50.0%) swpO=0 conn=6 myRSS=2807 php=12 phpRSS=1780 ap=41 tcp=59 topuser=madalice