INCIDENT 2026-08-29 21:27:10 trigger: php_rss=2062MB mysql_conn=19 ================================================================== load: 1.75 1.19 1.18 22/665 1245828 ncpu:10 mem_avail: 6977MB/13777MB (50.6%) swap_used:1505MB swapout:0/s blocked(D):0 running:25 iowait:0.1% steal:0.0% php: 21 procs / 2062MB heaviest user: infinium (17 procs, 1713MB) apache: 30 procs tcp_estab: 107 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2833 infinium 17 1796 root 248 1053 nobody 29 515 netdata 7 200 madalice 1 194 mailman 20 189 corpkicks 1 127 cpanellogin 1 72 dovenull 6 56 wp-toolkit 3 43 evolution 7 27 zabbix 1 25 mailnull 2 24 dovecot 3 22 named 1 16 aaa 1 15 lowrange 1 14 kurri 1 13 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB infinium 17 1817 madalice 1 197 corpkicks 1 130 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5259 MB Active(file): 4555 MB Inactive(file): 1272 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 616 MB CommitLimit: 10984 MB Committed_AS: 8744 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-19:08:29 7376 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2902012 8.6 Ssl 1-19:07:58 /usr/sbin/mariadbd 1245717 510022 madalice 216048 62.2 R 00:09 php-fpm: pool madalice_com_au 508924 1 netdata 179980 1.9 Ssl 1-19:07:27 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 175092 0.0 S 05:29:35 spamd child 1502904 1451906 root 168436 0.0 S 18:50:47 spamd child 1245772 1244054 corpkicks 151616 76.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1451906 1 root 129472 0.0 Ss 19:04:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1245777 1229520 infinium 127152 52.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245779 1244092 infinium 127012 66.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245775 1244095 infinium 126732 57.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245790 1244119 infinium 125624 0.0 S 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245776 1244110 infinium 125604 56.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245787 1244101 infinium 125460 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245774 1243956 infinium 125420 61.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245780 1244052 infinium 123560 52.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509266 1 root 120180 0.0 Ss 1-19:07:24 /usr/lib/systemd/systemd-journald 1245793 1244107 infinium 119200 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245788 1245781 infinium 113552 0.0 S 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245792 1229473 infinium 103724 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245784 1244056 infinium 103680 38.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245785 1245767 infinium 102644 38.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245786 1245782 infinium 94720 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1136288 1353308 cpanellogin 74088 0.0 S 29:37 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1245789 1243939 infinium 70904 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1245800 1244046 infinium 63756 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509236 509098 root 63348 0.0 Sl 1-19:07:24 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1245862 1243565 infinium 45020 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1353308 1 root 42428 0.1 Ss 38-18:45:50 cpsrvd (SSL) - waiting for connections 509640 508992 root 41024 0.0 Sl 1-19:07:22 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33344 0.0 Ss 19:04:55 lfd - sleeping 510022 1 root 28308 0.0 Ss 1-19:07:20 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 26412 0.2 Ssl 1-19:08:41 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 938582 1 wp-toolkit 25572 0.0 Ss 1-17:15:01 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1229432 506832 nobody 22764 0.0 S 02:42 /usr/sbin/httpd -k start 1469 1 root 22492 0.1 Ss 61-11:17:19 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1229473 506832 nobody 22320 0.0 S 02:40 /usr/sbin/httpd -k start 1229520 506832 nobody 22320 0.0 S 02:39 /usr/sbin/httpd -k start 1463 1 root 21380 0.0 Ss 61-11:17:19 tailwatchd 1244052 506832 nobody 21280 0.0 S 01:00 /usr/sbin/httpd -k start 1244095 506832 nobody 20544 0.0 S 00:59 /usr/sbin/httpd -k start 1244046 506832 nobody 20356 0.1 S 01:00 /usr/sbin/httpd -k start 1243939 506832 nobody 20164 0.0 S 01:04 /usr/sbin/httpd -k start 1243956 506832 nobody 19952 0.0 S 01:02 /usr/sbin/httpd -k start 1229471 506832 nobody 19816 0.0 S 02:40 /usr/sbin/httpd -k start 1243565 506832 nobody 19816 0.0 S 01:53 /usr/sbin/httpd -k start 1245767 506832 nobody 19704 0.0 S 00:02 /usr/sbin/httpd -k start 1229477 506832 nobody 19672 0.0 S 02:40 /usr/sbin/httpd -k start 1244053 506832 nobody 19552 0.0 S 01:00 /usr/sbin/httpd -k start 1244092 506832 nobody 19272 0.0 S 00:59 /usr/sbin/httpd -k start 1244119 506832 nobody 19244 0.0 S 00:59 /usr/sbin/httpd -k start 1244110 506832 nobody 19156 0.0 S 00:59 /usr/sbin/httpd -k start 1244056 506832 nobody 18912 0.0 S 01:00 /usr/sbin/httpd -k start 1244113 506832 nobody 18148 0.0 S 00:59 /usr/sbin/httpd -k start 1244107 506832 nobody 18076 0.0 S 00:59 /usr/sbin/httpd -k start 1244101 506832 nobody 17928 0.0 S 00:59 /usr/sbin/httpd -k start 1244049 506832 nobody 17668 0.0 S 01:00 /usr/sbin/httpd -k start 1244055 506832 nobody 17608 0.1 S 01:00 /usr/sbin/httpd -k start 508634 1 named 17396 0.0 Ssl 1-19:07:32 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1244121 506832 nobody 17216 0.0 S 00:59 /usr/sbin/httpd -k start 1244054 506832 nobody 17164 0.0 S 01:00 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4191137 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olympic/olympicfencing.com.au-ssl_log 816 coscom/coscom.com.au-ssl_log 131 evolution/app.evolutionerp.com.au 50 evolution/portal.evolutionerp.com.au-ssl_log 18 infinium/infinium.net.au-ssl_log 18 madalice/madalice.com.au-ssl_log 7 alison/alisonarts.com.au-ssl_log 3 evolution/app.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 816 93.123.109.228 76 52.139.37.240 55 20.203.141.11 53 31.59.160.30 18 203.54.180.238 11 198.54.114.70 3 118.127.40.55 2 2001:8003:464c:1f00:c63b:dd02:8c2b:bae3 2 172.93.101.38 2 170.64.135.172 1 49.183.15.140 1 4.232.148.111 1 114.119.159.70 1 114.119.143.226 1 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 22 GET /wp-login.php 18 GET /heartbeat.php 17 POST / 11 POST /wp-login.php 10 POST /index.php 8 GET / 4 POST /wp-json/Batch/v1 4 POST /wp-json/batch/v1/ 4 POST /wp-json/batch/v1 4 POST //wp-json/batch/v1 4 POST /wordpress/wp-json/batch/v1 4 POST /blog/wp-json/batch/v1 4 GET /store/diamond-bling-laces/ 4 GET /login 3 GET /wp-json/gravitysmtp/v1/tests/mock-data 3 GET /php.php 3 GET /404.shtml 2 POST /wp-cron.php 2 GET /yanz.php 2 GET /wp-json/wp/v2/users --- busiest 3 vhosts: top paths + last 10 requests --- == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 6 GET / 4 GET /login 3 GET /404.shtml 2 GET /wp-json/wp/v2/users 2 GET /wp-content/mysql.sql 2 GET /wp-content/debug.log 2 GET /.wp-config.php.swp 2 GET /workspaces/* 2 GET /.well-known/stripe.txt 2 GET /.well-known/stripe/ 2 GET /.well-known/acme-challenge/* 2 GET /.well-known/acme-challenge/ -- last 10 requests -- 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /waku/* HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/waku/*" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /webhook-test/* HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/webhook-test/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefo 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /webhook HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/webhook" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /webhook-waiting/* HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/webhook-waiting/*" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /webhook/* HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/webhook/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /webmin/package-updates/update.cgi HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/webmin/package-updates/update.cgi" "Mozilla/5.0 (X11; Linux x86_64) AppleW 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /workspaces/* HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/workspaces/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/12 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /wp-content/debug.log HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/wp-content/debug.log" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/201 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /wp-content/mysql.sql HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/wp-content/mysql.sql" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH 93.123.109.228 - - [29/Aug/2026:21:26:47 +1000] "GET /wp-json/wp/v2/users HTTP/1.1" 401 53 "http://cpcontacts.olympicfencing.com.au/wp-json/wp/v2/users" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /yanz.php 2 GET /wp-includes/customize/index.php 2 GET /wp-content/admin.php 2 GET /wp-admin.php 2 GET /wp-admin/css/about.php 2 GET /wp-admin/a.php 2 GET /num.php 2 GET /mini.php 2 GET /files/index.php 2 GET /file.php 2 GET /classwithtostring.php 2 GET /404.php -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:21:25:44 +1000] "GET /wp-comments-post.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:44 +1000] "GET /conf_upload.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:45 +1000] "GET /content.php888 HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:46 +1000] "GET /gecko-new.php.1 HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:46 +1000] "GET /OthioNDwMEK.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:48 +1000] "GET /sim.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:48 +1000] "GET /y.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:49 +1000] "GET /xleet.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:50 +1000] "GET /admin.php1 HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:21:25:50 +1000] "GET /M1.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au == -- top paths -- 16 POST / 10 POST /index.php 4 POST /wp-json/Batch/v1 4 POST /wp-json/batch/v1/ 4 POST /wp-json/batch/v1 4 POST //wp-json/batch/v1 4 POST /wordpress/wp-json/batch/v1 4 POST /blog/wp-json/batch/v1 -- last 10 requests -- 31.59.160.30 - - [29/Aug/2026:21:26:56 +1000] "POST /wp-json/Batch/v1 HTTP/1.1" 404 - "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 31.59.160.30 - - [29/Aug/2026:21:26:56 +1000] "POST //wp-json/batch/v1 HTTP/1.1" 404 - "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 31.59.160.30 - - [29/Aug/2026:21:26:57 +1000] "POST /wp-json/batch/v1/ HTTP/1.1" 404 - "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 31.59.160.30 - - [29/Aug/2026:21:26:57 +1000] "POST /blog/wp-json/batch/v1 HTTP/1.1" 404 - "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chro 31.59.160.30 - - [29/Aug/2026:21:26:57 +1000] "POST /wordpress/wp-json/batch/v1 HTTP/1.1" 404 - "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 31.59.160.30 - - [29/Aug/2026:21:26:58 +1000] "POST /index.php?rest_route=/batch/v1 HTTP/1.1" 200 39 "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G 31.59.160.30 - - [29/Aug/2026:21:26:58 +1000] "POST /index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 200 39 "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li 31.59.160.30 - - [29/Aug/2026:21:26:58 +1000] "POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 200 39 "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 31.59.160.30 - - [29/Aug/2026:21:26:59 +1000] "POST /?rest_route=/batch%2Fv1 HTTP/1.1" 200 39 "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C 31.59.160.30 - - [29/Aug/2026:21:26:59 +1000] "POST /?rest_route=/batch/v1 HTTP/1.1" 200 39 "http://app.evolutionerp.com.au/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr --- last 30 samples (run-up to this incident) --- 2026-08-29 21:24:40 L1=1.33 run=2 blk=0 avail=7979 (57.9%) swpO=2 conn=2 myRSS=2834 php=4 phpRSS=318 ap=70 tcp=37 topuser=madalice 2026-08-29 21:24:49 L1=1.13 run=1 blk=0 avail=8039 (58.4%) swpO=0 conn=3 myRSS=2834 php=4 phpRSS=318 ap=61 tcp=29 topuser=madalice 2026-08-29 21:24:50 L1=1.13 run=2 blk=0 avail=8059 (58.5%) swpO=0 conn=2 myRSS=2834 php=4 phpRSS=318 ap=59 tcp=28 topuser=madalice 2026-08-29 21:24:59 L1=1.03 run=1 blk=0 avail=8217 (59.6%) swpO=0 conn=3 myRSS=2834 php=3 phpRSS=195 ap=51 tcp=33 topuser=madalice 2026-08-29 21:25:00 L1=1.03 run=1 blk=0 avail=8231 (59.7%) swpO=0 conn=2 myRSS=2834 php=3 phpRSS=195 ap=49 tcp=27 topuser=madalice 2026-08-29 21:25:09 L1=0.95 run=6 blk=0 avail=8163 (59.3%) swpO=0 conn=3 myRSS=2834 php=5 phpRSS=377 ap=41 tcp=31 topuser=madalice 2026-08-29 21:25:11 L1=0.95 run=3 blk=0 avail=8011 (58.1%) swpO=0 conn=2 myRSS=2834 php=5 phpRSS=536 ap=39 tcp=29 topuser=corpkicks 2026-08-29 21:25:19 L1=1.04 run=1 blk=0 avail=8266 (60.0%) swpO=0 conn=3 myRSS=2834 php=3 phpRSS=195 ap=43 tcp=39 topuser=madalice 2026-08-29 21:25:21 L1=1.04 run=3 blk=0 avail=8278 (60.1%) swpO=0 conn=2 myRSS=2834 php=3 phpRSS=195 ap=41 tcp=27 topuser=madalice 2026-08-29 21:25:29 L1=0.88 run=2 blk=0 avail=8340 (60.5%) swpO=0 conn=3 myRSS=2834 php=3 phpRSS=195 ap=33 tcp=27 topuser=madalice 2026-08-29 21:25:31 L1=0.88 run=2 blk=0 avail=8353 (60.6%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=195 ap=31 tcp=22 topuser=madalice 2026-08-29 21:25:39 L1=0.74 run=1 blk=0 avail=8402 (61.0%) swpO=0 conn=3 myRSS=2834 php=3 phpRSS=195 ap=24 tcp=32 topuser=madalice 2026-08-29 21:25:41 L1=0.74 run=1 blk=0 avail=8533 (61.9%) swpO=0 conn=1 myRSS=2834 php=2 phpRSS=41 ap=24 tcp=33 topuser=root 2026-08-29 21:25:49 L1=0.63 run=1 blk=0 avail=8438 (61.2%) swpO=0 conn=3 myRSS=2834 php=3 phpRSS=173 ap=23 tcp=22 topuser=madalice 2026-08-29 21:25:51 L1=0.63 run=2 blk=0 avail=8453 (61.4%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=173 ap=21 tcp=22 topuser=madalice 2026-08-29 21:25:59 L1=0.53 run=2 blk=0 avail=8497 (61.7%) swpO=0 conn=3 myRSS=2834 php=3 phpRSS=173 ap=15 tcp=21 topuser=madalice 2026-08-29 21:26:01 L1=0.53 run=1 blk=0 avail=8500 (61.7%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=173 ap=15 tcp=17 topuser=madalice 2026-08-29 21:26:09 L1=0.68 run=2 blk=0 avail=8354 (60.6%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=173 ap=29 tcp=68 topuser=madalice 2026-08-29 21:26:11 L1=0.68 run=4 blk=0 avail=8055 (58.5%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=228 ap=77 tcp=57 topuser=madalice 2026-08-29 21:26:19 L1=0.58 run=1 blk=0 avail=8008 (58.1%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=197 ap=70 tcp=56 topuser=madalice 2026-08-29 21:26:21 L1=0.58 run=2 blk=0 avail=8013 (58.2%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=197 ap=68 tcp=55 topuser=madalice 2026-08-29 21:26:29 L1=0.81 run=4 blk=0 avail=8128 (59.0%) swpO=0 conn=1 myRSS=2834 php=3 phpRSS=197 ap=60 tcp=47 topuser=madalice 2026-08-29 21:26:31 L1=0.81 run=5 blk=0 avail=8093 (58.7%) swpO=0 conn=2 myRSS=2834 php=4 phpRSS=223 ap=58 tcp=44 topuser=madalice 2026-08-29 21:26:39 L1=0.76 run=3 blk=0 avail=8065 (58.5%) swpO=3 conn=1 myRSS=2833 php=4 phpRSS=330 ap=50 tcp=50 topuser=madalice 2026-08-29 21:26:41 L1=0.76 run=1 blk=0 avail=8074 (58.6%) swpO=3 conn=2 myRSS=2833 php=4 phpRSS=330 ap=48 tcp=50 topuser=madalice 2026-08-29 21:26:49 L1=0.80 run=1 blk=0 avail=8163 (59.3%) swpO=0 conn=1 myRSS=2833 php=4 phpRSS=330 ap=43 tcp=52 topuser=madalice 2026-08-29 21:26:51 L1=0.80 run=2 blk=0 avail=8072 (58.6%) swpO=0 conn=2 myRSS=2833 php=5 phpRSS=452 ap=43 tcp=52 topuser=madalice 2026-08-29 21:26:59 L1=0.76 run=1 blk=0 avail=8464 (61.4%) swpO=0 conn=1 myRSS=2833 php=2 phpRSS=41 ap=36 tcp=25 topuser=root 2026-08-29 21:27:01 L1=0.76 run=3 blk=0 avail=8301 (60.3%) swpO=0 conn=2 myRSS=2833 php=4 phpRSS=273 ap=34 tcp=27 topuser=alison 2026-08-29 21:27:10 L1=1.75 run=25 blk=0 avail=6977 (50.6%) swpO=0 conn=19 myRSS=2833 php=21 phpRSS=2062 ap=30 tcp=107 topuser=infinium