INCIDENT 2026-08-29 23:28:59 trigger: php_rss=1694MB ================================================================== load: 1.33 1.34 1.19 10/672 1670094 ncpu:10 mem_avail: 7277MB/13777MB (52.8%) swap_used:1784MB swapout:0/s blocked(D):0 running:9 iowait:0.0% steal:0.0% php: 12 procs / 1694MB heaviest user: madalice (9 procs, 1573MB) apache: 30 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2616 madalice 9 1609 root 255 1107 nobody 29 502 netdata 7 199 mailman 20 147 aaa 3 119 cpanellogin 1 61 dovenull 6 48 evolution 11 47 wp-toolkit 3 34 lowrange 2 28 kurri 2 27 zabbix 1 21 dovecot 3 20 named 1 15 infinium 1 14 mailnull 1 6 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1618 aaa 1 90 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5303 MB Active(file): 3451 MB Inactive(file): 2136 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 571 MB CommitLimit: 10984 MB Committed_AS: 8617 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-21:10:19 6372 /usr/bin/imunify-agent-proxy 1654078 root 04:28 62428 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2679496 8.4 Ssl 1-21:09:48 /usr/sbin/mariadbd 1669968 510022 madalice 257288 47.5 S 00:13 php-fpm: pool madalice_com_au 1670038 510022 madalice 203932 68.0 R 00:05 php-fpm: pool madalice_com_au 508924 1 netdata 182716 1.9 Ssl 1-21:09:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1670037 510022 madalice 179224 67.0 R 00:05 php-fpm: pool madalice_com_au 83639 1451906 root 168724 0.0 S 07:31:25 spamd child 1670042 510022 madalice 167108 64.4 R 00:05 php-fpm: pool madalice_com_au 1502904 1451906 root 161432 0.0 S 20:52:37 spamd child 1670043 510022 madalice 161232 63.0 R 00:05 php-fpm: pool madalice_com_au 1670035 510022 madalice 158492 73.6 S 00:05 php-fpm: pool madalice_com_au 1670040 510022 madalice 158460 60.8 R 00:05 php-fpm: pool madalice_com_au 1670039 510022 madalice 154596 52.2 R 00:05 php-fpm: pool madalice_com_au 1670041 510022 madalice 153780 54.2 S 00:05 php-fpm: pool madalice_com_au 509266 1 root 119400 0.0 Ss 1-21:09:14 /usr/lib/systemd/systemd-journald 1451906 1 root 114528 0.0 Ss 21:05:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1670064 1652402 aaa 99464 67.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668791 1353308 cpanellogin 63280 0.3 S 02:40 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1654078 1 root 62428 0.6 Ssl 04:28 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 59224 0.0 Sl 1-21:09:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42320 0.1 Ss 38-20:47:40 cpsrvd (SSL) - waiting for connections 509640 508992 root 41488 0.0 Sl 1-21:09:12 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 31816 0.0 Ss 21:06:45 lfd - sleeping 1670065 1469 root 30432 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 24916 0.1 Ss 61-13:19:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 24212 0.0 Ss 1-21:09:10 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1668300 506832 nobody 23596 0.0 S 03:29 /usr/sbin/httpd -k start 1652949 506832 nobody 23464 0.0 S 06:15 /usr/sbin/httpd -k start 1668622 506832 nobody 23096 0.0 S 02:59 /usr/sbin/httpd -k start 1654212 506832 nobody 23072 0.0 S 04:18 /usr/sbin/httpd -k start 1652402 506832 nobody 22684 0.1 S 07:32 /usr/sbin/httpd -k start 1652762 506832 nobody 22472 0.0 S 06:49 /usr/sbin/httpd -k start 483898 1 zabbix 22224 0.2 Ssl 1-21:10:31 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1668590 506832 nobody 21780 0.0 S 03:03 /usr/sbin/httpd -k start 1654213 506832 nobody 21728 0.0 S 04:18 /usr/sbin/httpd -k start 1669361 506832 nobody 21032 0.0 S 01:24 /usr/sbin/httpd -k start 1463 1 root 20440 0.0 Ss 61-13:19:09 tailwatchd 938582 1 wp-toolkit 20312 0.0 Ss 1-19:16:51 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1669530 506832 nobody 19840 0.0 S 01:03 /usr/sbin/httpd -k start 1668595 506832 nobody 19236 0.1 S 03:02 /usr/sbin/httpd -k start 1670047 506832 nobody 19208 0.2 S 00:04 /usr/sbin/httpd -k start 1669792 506832 nobody 18868 0.0 S 00:30 /usr/sbin/httpd -k start 1670050 506832 nobody 18348 0.0 S 00:03 /usr/sbin/httpd -k start 1670052 506832 nobody 18292 0.0 S 00:03 /usr/sbin/httpd -k start 1670046 506832 nobody 18104 0.0 S 00:04 /usr/sbin/httpd -k start 1670051 506832 nobody 18044 0.3 S 00:03 /usr/sbin/httpd -k start 1670053 506832 nobody 17984 0.3 S 00:03 /usr/sbin/httpd -k start 1670058 506832 nobody 16904 0.0 S 00:02 /usr/sbin/httpd -k start 1670044 506832 nobody 16820 0.0 S 00:05 /usr/sbin/httpd -k start 1670056 506832 nobody 16820 0.0 S 00:02 /usr/sbin/httpd -k start 1670060 506832 nobody 16772 0.0 S 00:02 /usr/sbin/httpd -k start 1670061 506832 nobody 16756 0.0 S 00:02 /usr/sbin/httpd -k start 1670062 506832 nobody 16700 0.0 S 00:02 /usr/sbin/httpd -k start 1566568 1471 root 16680 0.0 S 33:23 cPhulkd - dbprocessor 1651862 508511 aaa 15980 0.0 S 08:34 dovecot/imap 509671 508992 netdata 15808 2.1 Sl 1-21:09:12 /usr/libexec/netdata/plugins.d/apps.plugin 1 1471 1 root 15664 0.0 Ss 61-13:19:09 cPhulkd - processor 508634 1 named 15604 0.0 Ssl 1-21:09:22 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1482727 508511 lowrange 15356 0.0 S 56:24 dovecot/imap 954377 508511 aaa 15296 0.0 S 03:20:38 dovecot/imap 1637677 1471 root 15108 0.0 S 09:33 cPhulkd - processor - http socket --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4228465 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 195 madalice/madalice.com.au-ssl_log 59 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 59 kamcool/kamcool.com.au-ssl_log 57 evolution/portal.evolutionerp.com.au-ssl_log 26 evolution/my.evolutionerp.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 186 149.118.59.225 116 52.139.37.240 37 84.201.20.36 26 203.54.180.238 13 185.161.210.61 5 118.127.40.55 3 114.119.146.16 2 91.92.243.234 2 209.141.52.196 2 114.119.140.234 1 52.167.144.181 1 50.6.207.27 1 3.210.223.61 1 207.46.13.168 1 193.46.255.93 --- top request paths across all vhosts (last 3 min) --- 78 GET /wp-login.php 74 GET /wp-admin/index.php 40 POST /wp-login.php 26 GET /heartbeat.php 12 POST /index.php 4 POST /wp-cron.php 3 GET /index.php 2 GET /zup.php 2 GET /z.php 2 GET /zafir1.php 2 GET /xxx.php 2 GET /xmrlpc.php 2 GET /ws49.php 2 GET /wp-wordfence-waf.php 2 GET /wp-update.php 2 GET /wp-info.php 2 GET /wp-includes/Text/Diff/Engine/ 2 GET /wp-includes/interactivity-api/index.php 2 GET /wp-includes/images/media/ 2 GET /wp-header-json.php --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 77 GET /wp-login.php 74 GET /wp-admin/index.php 40 POST /wp-login.php 3 POST /wp-cron.php 1 POST /graphql -- last 10 requests -- 149.118.59.225 - - [29/Aug/2026:23:28:42 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472 149.118.59.225 - - [29/Aug/2026:23:28:43 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:28:44 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472 149.118.59.225 - - [29/Aug/2026:23:28:45 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:28:46 +1000] "POST /wp-login.php HTTP/1.1" 200 7291 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0" 149.118.59.225 - - [29/Aug/2026:23:28:47 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577 149.118.59.225 - - [29/Aug/2026:23:28:48 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:28:49 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577 149.118.59.225 - - [29/Aug/2026:23:28:49 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 118.127.40.55 - - [29/Aug/2026:23:28:51 +1000] "POST /wp-cron.php?doing_wp_cron=1788010131.4097259044647216796875 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://aaadownunder.com.au" == madalice/madalice.com.au-ssl_log == -- top paths -- 12 POST /index.php 1 POST / 1 GET /wp-config.php.save 1 GET /wp-config.php.bak 1 GET /wp-config.php~ 1 GET /store/sydney-roosters-af1/ 1 GET /store/posty-af1/ 1 GET /store/pink-barbie-af1s/ 1 GET /store/hand-painted-nike-af1-wildroses/ 1 GET /store/hand-painted-nike-af1-roosters/ 1 GET /store/graffiti-airmax-90-custom-shoes/ 1 GET /store/gift-card-2/ -- last 10 requests -- 185.161.210.61 - - [29/Aug/2026:23:28:54 +1000] "POST /index.php?rest_route=/wordfence-login-security/v1/internal/passkey-login/begin HTTP/1.1" 403 98 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20 185.161.210.61 - - [29/Aug/2026:23:28:55 +1000] "POST /index.php?rest_route=/wc/pos/v1/catalog/create HTTP/1.1" 401 86 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:28:54 +1000] "POST /index.php?rest_route=/wordfence/v1/authenticate HTTP/1.1" 401 99 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:28:54 +1000] "POST /index.php?rest_route=/wc-ast/v3/orders/(?P[\\d]+)/shipment-trackings HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20 185.161.210.61 - - [29/Aug/2026:23:28:55 +1000] "POST /index.php?rest_route=/wc-shipment-tracking/v3/orders/(?P[\\d]+)/shipment-trackings HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:1 185.161.210.61 - - [29/Aug/2026:23:28:54 +1000] "POST /index.php?rest_route=/wordfence/v1/disconnect HTTP/1.1" 401 96 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:28:56 +1000] "POST /index.php?rest_route=/wc/pos/v1/catalog/create HTTP/1.1" 401 86 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:28:56 +1000] "POST /index.php?rest_route=/wordfence-login-security/v1/internal/passkey-login/finish HTTP/1.1" 403 98 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/2 185.161.210.61 - - [29/Aug/2026:23:28:56 +1000] "POST /index.php?rest_route=/wordfence/v1/disconnect HTTP/1.1" 401 96 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:28:56 +1000] "POST /index.php?rest_route=/wc-shipment-tracking/v3/orders/(?P[\\d]+)/shipment-trackings HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:1 == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-info.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/interactivity-api/index.php 1 GET /wp-includes/images/media/ -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:23:27:55 +1000] "GET /vendor/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:56 +1000] "GET /wp-content/plugins/ftde.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:56 +1000] "GET /wp-content/uploads/admin.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:56 +1000] "GET /wp-includes/Text/Diff/Engine/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:56 +1000] "GET /z.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:57 +1000] "GET /f35.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:57 +1000] "GET /file61.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:57 +1000] "GET /mah.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:57 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:27:57 +1000] "GET /v.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 23:26:31 L1=1.89 run=4 blk=0 avail=8458 (61.4%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=487 ap=20 tcp=32 topuser=madalice 2026-08-29 23:26:38 L1=1.98 run=1 blk=0 avail=8563 (62.2%) swpO=0 conn=3 myRSS=2616 php=4 phpRSS=353 ap=19 tcp=33 topuser=madalice 2026-08-29 23:26:41 L1=1.82 run=2 blk=0 avail=8564 (62.2%) swpO=0 conn=3 myRSS=2616 php=4 phpRSS=353 ap=19 tcp=32 topuser=madalice 2026-08-29 23:26:48 L1=2.16 run=3 blk=0 avail=8516 (61.8%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=431 ap=19 tcp=36 topuser=madalice 2026-08-29 23:26:51 L1=1.98 run=4 blk=0 avail=8420 (61.1%) swpO=0 conn=5 myRSS=2616 php=7 phpRSS=580 ap=19 tcp=36 topuser=madalice 2026-08-29 23:26:58 L1=1.91 run=2 blk=0 avail=8503 (61.7%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=440 ap=19 tcp=31 topuser=madalice 2026-08-29 23:27:01 L1=1.83 run=2 blk=0 avail=8523 (61.9%) swpO=0 conn=5 myRSS=2616 php=5 phpRSS=430 ap=19 tcp=28 topuser=madalice 2026-08-29 23:27:09 L1=1.93 run=5 blk=0 avail=8452 (61.3%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=523 ap=16 tcp=31 topuser=madalice 2026-08-29 23:27:11 L1=1.85 run=3 blk=0 avail=8350 (60.6%) swpO=0 conn=5 myRSS=2616 php=6 phpRSS=651 ap=16 tcp=29 topuser=madalice 2026-08-29 23:27:19 L1=1.78 run=1 blk=0 avail=8721 (63.3%) swpO=0 conn=3 myRSS=2616 php=3 phpRSS=193 ap=16 tcp=30 topuser=madalice 2026-08-29 23:27:21 L1=1.72 run=2 blk=0 avail=8662 (62.9%) swpO=0 conn=5 myRSS=2616 php=4 phpRSS=284 ap=16 tcp=28 topuser=madalice 2026-08-29 23:27:29 L1=1.58 run=3 blk=0 avail=8721 (63.3%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=272 ap=15 tcp=32 topuser=madalice 2026-08-29 23:27:31 L1=1.78 run=3 blk=0 avail=8743 (63.5%) swpO=0 conn=5 myRSS=2616 php=4 phpRSS=225 ap=15 tcp=30 topuser=aaa 2026-08-29 23:27:39 L1=1.71 run=3 blk=0 avail=8683 (63.0%) swpO=0 conn=3 myRSS=2616 php=4 phpRSS=252 ap=18 tcp=32 topuser=madalice 2026-08-29 23:27:41 L1=1.66 run=3 blk=0 avail=8480 (61.6%) swpO=0 conn=5 myRSS=2616 php=7 phpRSS=537 ap=18 tcp=34 topuser=infinium 2026-08-29 23:27:49 L1=1.60 run=3 blk=0 avail=8573 (62.2%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=393 ap=17 tcp=32 topuser=madalice 2026-08-29 23:27:51 L1=1.56 run=2 blk=0 avail=8679 (63.0%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=258 ap=17 tcp=28 topuser=madalice 2026-08-29 23:27:59 L1=1.51 run=2 blk=0 avail=8752 (63.5%) swpO=0 conn=3 myRSS=2616 php=4 phpRSS=168 ap=18 tcp=36 topuser=madalice 2026-08-29 23:28:01 L1=1.55 run=1 blk=0 avail=8733 (63.4%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=168 ap=18 tcp=32 topuser=madalice 2026-08-29 23:28:09 L1=1.59 run=2 blk=0 avail=8716 (63.3%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=228 ap=16 tcp=29 topuser=madalice 2026-08-29 23:28:11 L1=1.46 run=3 blk=0 avail=8576 (62.3%) swpO=0 conn=2 myRSS=2616 php=5 phpRSS=398 ap=16 tcp=28 topuser=corpkicks 2026-08-29 23:28:19 L1=1.42 run=3 blk=0 avail=8725 (63.3%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=227 ap=15 tcp=31 topuser=madalice 2026-08-29 23:28:21 L1=1.39 run=3 blk=0 avail=8843 (64.2%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=85 ap=15 tcp=28 topuser=aaa 2026-08-29 23:28:29 L1=1.44 run=2 blk=0 avail=8728 (63.4%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=229 ap=14 tcp=33 topuser=madalice 2026-08-29 23:28:32 L1=1.40 run=3 blk=0 avail=8634 (62.7%) swpO=0 conn=2 myRSS=2616 php=5 phpRSS=300 ap=15 tcp=31 topuser=madalice 2026-08-29 23:28:39 L1=1.37 run=2 blk=0 avail=8672 (62.9%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=237 ap=15 tcp=30 topuser=madalice 2026-08-29 23:28:42 L1=1.42 run=2 blk=1 avail=8680 (63.0%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=227 ap=15 tcp=28 topuser=madalice 2026-08-29 23:28:49 L1=1.39 run=2 blk=0 avail=8649 (62.8%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=259 ap=15 tcp=32 topuser=madalice 2026-08-29 23:28:52 L1=1.27 run=3 blk=0 avail=8659 (62.9%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=172 ap=15 tcp=29 topuser=madalice 2026-08-29 23:28:59 L1=1.33 run=9 blk=0 avail=7277 (52.8%) swpO=0 conn=9 myRSS=2616 php=12 phpRSS=1694 ap=30 tcp=47 topuser=madalice