INCIDENT 2026-08-30 00:42:05 trigger: php_rss=1668MB ================================================================== load: 1.41 0.88 1.12 2/681 1928186 ncpu:10 mem_avail: 7248MB/13777MB (52.6%) swap_used:1813MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 13 procs / 1668MB heaviest user: madalice (10 procs, 1560MB) apache: 37 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2667 madalice 11 1574 root 254 1047 nobody 35 594 netdata 7 198 mailman 20 143 alison 1 74 cpanellogin 1 62 dovenull 6 49 evolution 11 47 wp-toolkit 3 34 lowrange 2 29 infinium 2 29 kurri 2 27 zabbix 1 22 dovecot 3 20 named 1 15 vinesit 1 14 corpkicks 1 14 candyfabcom 1 14 --- php workers by user --- USER PROCS RSS_MB madalice 10 1560 alison 1 75 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5924 MB Active(file): 3575 MB Inactive(file): 2652 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 562 MB CommitLimit: 10984 MB Committed_AS: 8517 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-22:23:25 6600 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2731600 8.3 Ssl 1-22:22:54 /usr/sbin/mariadbd 508924 1 netdata 181476 1.9 Ssl 1-22:22:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169548 0.0 S 08:44:31 spamd child 1502904 1451906 root 161412 0.0 S 22:05:43 spamd child 1927446 510022 madalice 160576 18.7 S 00:50 php-fpm: pool madalice_com_au 1927443 510022 madalice 160560 16.7 S 00:50 php-fpm: pool madalice_com_au 1927445 510022 madalice 159776 14.6 S 00:50 php-fpm: pool madalice_com_au 1927444 510022 madalice 159720 16.5 S 00:50 php-fpm: pool madalice_com_au 1927451 510022 madalice 159708 14.6 S 00:49 php-fpm: pool madalice_com_au 1927941 510022 madalice 159692 34.0 S 00:17 php-fpm: pool madalice_com_au 1927942 510022 madalice 159644 28.2 S 00:17 php-fpm: pool madalice_com_au 1928063 510022 madalice 159552 27.1 S 00:09 php-fpm: pool madalice_com_au 1928062 510022 madalice 159532 27.2 S 00:09 php-fpm: pool madalice_com_au 1928064 510022 madalice 159136 27.4 S 00:09 php-fpm: pool madalice_com_au 509266 1 root 120808 0.0 Ss 1-22:22:20 /usr/lib/systemd/systemd-journald 1451906 1 root 113568 0.0 Ss 22:18:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1928129 1912986 alison 80864 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1878774 1353308 cpanellogin 64188 0.1 S 12:15 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 55580 0.0 Sl 1-22:22:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 42268 0.0 Sl 1-22:22:18 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42220 0.1 Ss 38-22:00:46 cpsrvd (SSL) - waiting for connections 1777392 1 root 37332 0.0 Ss 42:03 lfd - sleeping 1469 1 root 25284 0.1 Ss 61-14:32:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 24200 0.0 Ss 1-22:22:16 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 23352 0.2 Ssl 1-22:23:37 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1895327 506832 nobody 21780 0.0 S 09:32 /usr/sbin/httpd -k start 1912987 506832 nobody 21180 0.0 S 02:24 /usr/sbin/httpd -k start 1912986 506832 nobody 21088 0.1 S 02:24 /usr/sbin/httpd -k start 1927458 506832 nobody 20668 0.0 S 00:48 /usr/sbin/httpd -k start 1463 1 root 20420 0.0 Ss 61-14:32:15 tailwatchd 938582 1 wp-toolkit 20380 0.0 Ss 1-20:29:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1927501 506832 nobody 20304 0.0 S 00:41 /usr/sbin/httpd -k start 1927567 506832 nobody 20228 0.0 S 00:40 /usr/sbin/httpd -k start 1912807 506832 nobody 19944 0.1 S 02:49 /usr/sbin/httpd -k start 1927568 506832 nobody 19700 0.0 S 00:40 /usr/sbin/httpd -k start 1927564 506832 nobody 19632 0.0 S 00:40 /usr/sbin/httpd -k start 1927241 506832 nobody 19532 0.0 S 01:08 /usr/sbin/httpd -k start 1927481 506832 nobody 19456 0.0 S 00:44 /usr/sbin/httpd -k start 1927459 506832 nobody 19408 0.0 S 00:48 /usr/sbin/httpd -k start 1927493 506832 nobody 19268 0.0 S 00:42 /usr/sbin/httpd -k start 1928118 506832 nobody 19180 0.0 S 00:04 /usr/sbin/httpd -k start 1928089 506832 nobody 19112 0.2 S 00:05 /usr/sbin/httpd -k start 1927947 506832 nobody 19064 0.1 S 00:16 /usr/sbin/httpd -k start 1927577 506832 nobody 18900 0.0 S 00:40 /usr/sbin/httpd -k start 1927495 506832 nobody 18680 0.1 S 00:42 /usr/sbin/httpd -k start 1927508 506832 nobody 18544 0.0 S 00:41 /usr/sbin/httpd -k start 1927562 506832 nobody 18384 0.0 S 00:40 /usr/sbin/httpd -k start 1927572 506832 nobody 17928 0.1 S 00:40 /usr/sbin/httpd -k start 1927502 506832 nobody 17784 0.0 S 00:41 /usr/sbin/httpd -k start 1927503 506832 nobody 17524 0.0 S 00:41 /usr/sbin/httpd -k start 1927993 506832 nobody 17376 0.0 S 00:12 /usr/sbin/httpd -k start 1927570 506832 nobody 17332 0.1 S 00:40 /usr/sbin/httpd -k start 1927492 506832 nobody 17328 0.0 S 00:42 /usr/sbin/httpd -k start 1928119 506832 nobody 17296 0.0 S 00:04 /usr/sbin/httpd -k start 1927571 506832 nobody 17200 0.0 S 00:40 /usr/sbin/httpd -k start 1928120 506832 nobody 17076 0.2 S 00:04 /usr/sbin/httpd -k start 1928086 506832 nobody 16620 0.0 S 00:06 /usr/sbin/httpd -k start 1928088 506832 nobody 16560 0.0 S 00:05 /usr/sbin/httpd -k start 1928117 506832 nobody 16560 0.0 S 00:04 /usr/sbin/httpd -k start 1910689 1471 root 16552 0.0 S 06:47 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4261002 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au-ssl_log 262 cosgrovecreative/cosgrovecreative.com.au-ssl_log 148 candyfabcom/candyfab.com.au-ssl_log 53 madalice/madalice.com.au-ssl_log 31 evolution/portal.evolutionerp.com.au-ssl_log 20 infinium/infinium.net.au-ssl_log 5 evolution/evolutionerp.com.au-ssl_log 4 speedlin/speedlinefencing.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 2 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 304 34.116.162.55 106 20.151.200.44 53 158.23.184.117 27 32.195.67.60 20 203.54.180.238 3 118.127.40.55 2 43.155.27.244 2 217.64.102.75 2 114.119.143.104 1 57.129.136.36 1 50.6.200.195 1 50.6.169.131 1 34.196.51.17 1 178.105.183.10 1 170.64.135.172 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 9 POST / 6 GET / 3 GET /wp-login.php 2 POST /wp-login.php 2 POST /wp-cron.php 2 GET /zend/.env 2 GET /yii/.env 2 GET /www/.env 2 GET /wp/.env 2 GET /wordpress/.env 2 GET /web/.env 2 GET /vue/.env 2 GET /vite/.env 2 GET /vendor/.env 2 GET /var/www/html/.env 2 GET /var/www/.env 2 GET /v3/.env 2 GET /v2/.env 2 GET /v1/.env --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /ztv.php 1 GET /zoz.php 1 GET /zend/.env 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php 1 GET /yii/.env 1 GET /xcre1.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /x0x.php -- last 10 requests -- 34.116.162.55 - - [30/Aug/2026:00:42:00 +1000] "GET /exapi/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:00 +1000] "GET /sitemaps/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:00 +1000] "GET /.env.backup1 HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:01 +1000] "GET /.env.backup2 HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:01 +1000] "GET /logs/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:01 +1000] "GET /cache/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:01 +1000] "GET /mailer/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:02 +1000] "GET /mail/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:02 +1000] "GET /email/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:02 +1000] "GET /smtp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /var/www/html/.env 1 GET /var/www/.env -- last 10 requests -- 34.116.162.55 - - [30/Aug/2026:00:42:02 +1000] "GET /tmp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:02 +1000] "GET /temp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:03 +1000] "GET /lab/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:03 +1000] "GET /cronlab/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:03 +1000] "GET /cron/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:04 +1000] "GET /en/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:04 +1000] "GET /administrator/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:04 +1000] "GET /psnlink/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:04 +1000] "GET /exapi/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.162.55 - - [30/Aug/2026:00:42:05 +1000] "GET /sitemaps/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 1 GET /xmr.php 1 GET /xmlrpc.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/theme-compat 1 GET /wp-includes/Text.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Test.php 1 GET /wp-includes/style-engine/wp-conflg.php 1 GET /wp-includes/Requests/Exception/file.php 1 GET /wp-includes/pomo.php 1 GET /wp-includes/pomo/ -- last 10 requests -- 158.23.184.117 - - [30/Aug/2026:00:41:55 +1000] "GET /hehe.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:00:41:55 +1000] "GET /wp-includes/PHPMailer.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:00:41:55 +1000] "GET /wp-content/upgrade/alfanew.php7 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 158.23.184.117 - - [30/Aug/2026:00:41:56 +1000] "GET /admin/alfa-rex.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:00:41:56 +1000] "GET /wp-content/export.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:00:41:56 +1000] "GET /new.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:00:41:56 +1000] "GET /wp-content/plugins/revslider/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar 158.23.184.117 - - [30/Aug/2026:00:41:56 +1000] "GET /wp-content/images/uploads/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 158.23.184.117 - - [30/Aug/2026:00:41:57 +1000] "GET /tools.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:00:41:57 +1000] "GET /wp-content/uploads/my.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 00:39:45 L1=0.56 run=4 blk=0 avail=8275 (60.1%) swpO=1 conn=4 myRSS=2667 php=6 phpRSS=629 ap=22 tcp=35 topuser=madalice 2026-08-30 00:39:45 L1=0.56 run=6 blk=0 avail=8271 (60.0%) swpO=1 conn=1 myRSS=2667 php=6 phpRSS=629 ap=22 tcp=35 topuser=madalice 2026-08-30 00:39:55 L1=0.55 run=2 blk=0 avail=8469 (61.5%) swpO=0 conn=4 myRSS=2667 php=5 phpRSS=416 ap=20 tcp=33 topuser=madalice 2026-08-30 00:39:55 L1=0.55 run=3 blk=0 avail=8467 (61.5%) swpO=0 conn=1 myRSS=2667 php=5 phpRSS=419 ap=20 tcp=33 topuser=madalice 2026-08-30 00:40:05 L1=0.62 run=2 blk=0 avail=8629 (62.6%) swpO=0 conn=4 myRSS=2667 php=3 phpRSS=196 ap=20 tcp=31 topuser=madalice 2026-08-30 00:40:05 L1=0.62 run=4 blk=0 avail=8629 (62.6%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=196 ap=20 tcp=31 topuser=madalice 2026-08-30 00:40:15 L1=0.60 run=3 blk=0 avail=8659 (62.9%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=196 ap=16 tcp=28 topuser=madalice 2026-08-30 00:40:15 L1=0.60 run=1 blk=0 avail=8660 (62.9%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=196 ap=16 tcp=28 topuser=madalice 2026-08-30 00:40:25 L1=0.59 run=2 blk=0 avail=8686 (63.0%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=169 ap=16 tcp=29 topuser=madalice 2026-08-30 00:40:25 L1=0.59 run=3 blk=0 avail=8686 (63.0%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=169 ap=16 tcp=29 topuser=madalice 2026-08-30 00:40:35 L1=0.50 run=3 blk=0 avail=8688 (63.1%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=169 ap=16 tcp=27 topuser=madalice 2026-08-30 00:40:35 L1=0.50 run=2 blk=0 avail=8689 (63.1%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=169 ap=16 tcp=27 topuser=madalice 2026-08-30 00:40:45 L1=0.42 run=5 blk=0 avail=8769 (63.7%) swpO=0 conn=1 myRSS=2667 php=4 phpRSS=139 ap=15 tcp=29 topuser=speedlin 2026-08-30 00:40:45 L1=0.42 run=5 blk=0 avail=8766 (63.6%) swpO=0 conn=1 myRSS=2667 php=4 phpRSS=144 ap=15 tcp=29 topuser=speedlin 2026-08-30 00:40:55 L1=0.43 run=1 blk=0 avail=8695 (63.1%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=169 ap=15 tcp=30 topuser=madalice 2026-08-30 00:40:55 L1=0.43 run=3 blk=0 avail=8694 (63.1%) swpO=0 conn=1 myRSS=2667 php=3 phpRSS=169 ap=15 tcp=30 topuser=madalice 2026-08-30 00:41:05 L1=0.44 run=2 blk=0 avail=8396 (60.9%) swpO=0 conn=1 myRSS=2667 php=5 phpRSS=517 ap=16 tcp=34 topuser=corpkicks 2026-08-30 00:41:05 L1=0.44 run=3 blk=0 avail=8394 (60.9%) swpO=0 conn=1 myRSS=2667 php=5 phpRSS=518 ap=16 tcp=34 topuser=corpkicks 2026-08-30 00:41:15 L1=0.53 run=2 blk=0 avail=8510 (61.8%) swpO=0 conn=1 myRSS=2667 php=5 phpRSS=404 ap=16 tcp=34 topuser=olympic 2026-08-30 00:41:15 L1=0.53 run=4 blk=0 avail=8509 (61.8%) swpO=0 conn=3 myRSS=2667 php=5 phpRSS=405 ap=16 tcp=34 topuser=olympic 2026-08-30 00:41:25 L1=0.68 run=2 blk=0 avail=7777 (56.5%) swpO=1 conn=1 myRSS=2667 php=10 phpRSS=1094 ap=35 tcp=65 topuser=madalice 2026-08-30 00:41:25 L1=0.78 run=5 blk=0 avail=7774 (56.4%) swpO=1 conn=3 myRSS=2667 php=10 phpRSS=1097 ap=35 tcp=63 topuser=madalice 2026-08-30 00:41:35 L1=0.66 run=2 blk=0 avail=7784 (56.5%) swpO=0 conn=3 myRSS=2667 php=8 phpRSS=971 ap=45 tcp=35 topuser=madalice 2026-08-30 00:41:35 L1=0.66 run=1 blk=0 avail=7784 (56.5%) swpO=0 conn=1 myRSS=2667 php=8 phpRSS=971 ap=45 tcp=33 topuser=madalice 2026-08-30 00:41:45 L1=0.64 run=2 blk=0 avail=7842 (56.9%) swpO=0 conn=3 myRSS=2667 php=8 phpRSS=971 ap=35 tcp=35 topuser=madalice 2026-08-30 00:41:45 L1=0.64 run=2 blk=0 avail=7842 (56.9%) swpO=0 conn=1 myRSS=2667 php=8 phpRSS=971 ap=35 tcp=35 topuser=madalice 2026-08-30 00:41:55 L1=1.14 run=5 blk=0 avail=7621 (55.3%) swpO=0 conn=3 myRSS=2667 php=11 phpRSS=1290 ap=32 tcp=44 topuser=madalice 2026-08-30 00:41:55 L1=1.14 run=4 blk=0 avail=7621 (55.3%) swpO=0 conn=1 myRSS=2667 php=11 phpRSS=1290 ap=32 tcp=44 topuser=madalice 2026-08-30 00:42:05 L1=1.41 run=4 blk=0 avail=7248 (52.6%) swpO=0 conn=3 myRSS=2667 php=13 phpRSS=1668 ap=37 tcp=44 topuser=madalice 2026-08-30 00:42:05 L1=1.41 run=5 blk=0 avail=7248 (52.6%) swpO=0 conn=2 myRSS=2667 php=13 phpRSS=1668 ap=37 tcp=44 topuser=madalice