INCIDENT 2026-08-30 02:54:03 trigger: php_rss=1529MB ================================================================== load: 1.26 0.89 0.92 7/662 2381011 ncpu:10 mem_avail: 7580MB/13777MB (55.0%) swap_used:1826MB swapout:0/s blocked(D):0 running:7 iowait:0.0% steal:0.0% php: 10 procs / 1529MB heaviest user: madalice (7 procs, 1453MB) apache: 20 procs tcp_estab: 34 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2705 madalice 7 1319 root 258 1111 nobody 19 321 netdata 7 197 mailman 20 127 evolution 12 83 cpanellogin 1 62 dovenull 6 45 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 21 dovecot 3 19 named 1 15 mailnull 2 15 infinium 1 14 polkitd 1 5 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 7 1268 evolution 3 66 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5837 MB Active(file): 4398 MB Inactive(file): 1831 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 683 MB CommitLimit: 10984 MB Committed_AS: 8067 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-00:35:24 4236 /usr/bin/imunify-agent-proxy 2363150 root 07:03 1264 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))'; /usr/libexec/report-command-error /opt/imunify360/venv/share/imunify360/scripts/imunify-check-pkg-integr --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2770616 8.1 Ssl 2-00:34:53 /usr/sbin/mariadbd 2380972 510022 madalice 246572 122 R 00:01 php-fpm: pool madalice_com_au 2380971 510022 madalice 235416 123 R 00:01 php-fpm: pool madalice_com_au 2380975 510022 madalice 216572 114 R 00:01 php-fpm: pool madalice_com_au 2380973 510022 madalice 212644 119 R 00:01 php-fpm: pool madalice_com_au 2328310 2277352 root 181208 0.0 S 15:53 spamd child 508924 1 netdata 176968 1.9 Ssl 2-00:34:22 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175936 0.2 Ss 30:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168480 0.0 S 15:53 spamd child 2380899 510022 madalice 159764 32.3 S 00:08 php-fpm: pool madalice_com_au 2380968 510022 madalice 136260 70.0 S 00:02 php-fpm: pool madalice_com_au 2380969 510022 madalice 136228 70.0 S 00:02 php-fpm: pool madalice_com_au 509266 1 root 127688 0.0 Ss 2-00:34:19 /usr/lib/systemd/systemd-journald 2293638 1353308 cpanellogin 63800 0.1 S 26:20 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 55596 0.0 Sl 2-00:34:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43204 0.0 Sl 2-00:34:17 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 41056 0.1 Ss 39-00:12:45 cpsrvd (SSL) - waiting for connections 2381016 2379251 evolution 40616 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2380981 2380079 evolution 40556 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2275833 1 root 36840 0.0 Ss 31:49 lfd - sleeping 2380980 1469 root 29912 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 23800 0.1 Ss 61-16:44:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-00:34:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 21780 0.2 Ssl 2-00:35:36 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2379618 506832 nobody 21264 0.1 S 01:49 /usr/sbin/httpd -k start 2379251 506832 nobody 20760 0.0 S 02:29 /usr/sbin/httpd -k start 2364390 506832 nobody 20628 0.0 S 04:48 /usr/sbin/httpd -k start 2379272 506832 nobody 20624 0.0 S 02:28 /usr/sbin/httpd -k start 2380102 506832 nobody 20416 0.0 S 00:56 /usr/sbin/httpd -k start 1463 1 root 20232 0.0 Ss 61-16:44:14 tailwatchd 2364767 506832 nobody 20036 0.0 S 04:08 /usr/sbin/httpd -k start 2364784 506832 nobody 19876 0.0 S 04:07 /usr/sbin/httpd -k start 2379650 506832 nobody 19244 0.1 S 01:47 /usr/sbin/httpd -k start 2380898 506832 nobody 19040 0.1 S 00:08 /usr/sbin/httpd -k start 2363694 506832 nobody 18876 0.0 S 05:59 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18780 0.0 Ss 1-22:41:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2379155 506832 nobody 18720 0.0 S 02:38 /usr/sbin/httpd -k start 2379271 506832 nobody 18600 0.1 S 02:28 /usr/sbin/httpd -k start 2364780 506832 nobody 18440 0.1 S 04:07 /usr/sbin/httpd -k start 2379843 506832 nobody 17804 0.1 S 01:18 /usr/sbin/httpd -k start 2380079 506832 nobody 17684 0.0 S 00:59 /usr/sbin/httpd -k start 2380114 506832 nobody 17040 0.0 S 00:55 /usr/sbin/httpd -k start 2327413 1471 root 16272 0.0 S 17:45 cPhulkd - dbprocessor 509671 508992 netdata 15956 2.1 Sl 2-00:34:17 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15720 0.0 Ssl 2-00:34:27 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1471 1 root 15164 0.0 Ss 61-16:44:14 cPhulkd - processor 1482727 508511 lowrange 15096 0.0 S 04:21:29 dovecot/imap 1876631 508511 infinium 14972 0.0 S 02:27:32 dovecot/imap 1742095 508511 lowrange 14652 0.0 S 03:07:11 dovecot/imap 2380786 508511 kurri 14416 0.0 S 00:18 dovecot/imap 4180059 4180015 evolution 13580 0.0 Ss 2-02:54:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2379260 508511 root 12880 0.0 S 02:29 dovecot/auth -w 3883280 508511 kurri 12668 0.0 S 12:52:14 dovecot/imap 2380976 506832 nobody 12368 0.0 S 00:01 /usr/sbin/httpd -k start 2381040 506832 nobody 12368 0.0 S 00:00 /usr/sbin/httpd -k start 2381041 506832 nobody 12368 0.0 S 00:00 /usr/sbin/httpd -k start 938585 1 wp-toolkit 11888 0.0 Ss 1-22:41:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508518 508511 dovenull 10564 0.0 S 2-00:34:27 dovecot/imap-login 506832 1 root 10424 0.0 Ss 2-00:34:52 /usr/sbin/httpd -k start 508514 508511 dovenull 10280 0.0 S 2-00:34:27 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4295059 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 258 otterfencing/otterfencing.com.au-ssl_log 173 aaa/aaadownunder.com.au-ssl_log 121 alison/alisonarts.com.au 50 alison/alisonarts.com.au-ssl_log 38 evolution/portal.evolutionerp.com.au-ssl_log 14 tubesupplies/tubesupplies.com.au-ssl_log 8 customc/customcentral.com.au-ssl_log 5 madalice/madalice.com.au-ssl_log 4 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 258 34.116.241.224 185 20.48.250.41 120 20.48.179.39 76 52.139.37.240 14 203.54.180.238 5 91.92.40.30 2 114.119.137.101 1 98.84.60.17 1 74.248.24.12 1 54.225.148.123 1 52.71.218.25 1 52.207.47.227 1 44.223.232.55 1 44.215.235.20 1 3.94.156.104 --- top request paths across all vhosts (last 3 min) --- 14 GET /heartbeat.php 4 POST / 4 GET /vx.php 4 GET /store/custom-newcastle-knights-kids/ 4 GET /elp.php 4 GET /666.php 3 GET /zu.php 3 GET /zoo.php 3 GET /xs.php 3 GET /ww.php 3 GET /ws68.php 3 GET /ws66.php 3 GET /ws58.php 3 GET /wp-style.php 3 GET /wp-link10.php 3 GET /w1px.php 3 GET /users.php 3 GET /to.php 3 GET /thui.php 3 GET /shlo.php --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.116.241.224 - - [30/Aug/2026:02:53:26 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:26 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:26 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:27 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:27 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:27 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:27 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:28 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:28 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.241.224 - - [30/Aug/2026:02:53:28 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 2 GET /vx.php 2 GET /term.php 2 GET /file.php 2 GET /elp.php 2 GET /bgymj.php 2 GET /aaa.php 2 GET /666.php 2 GET /155.php 1 GET /zxekqlxb.php 1 GET /zup.php73 1 GET /zu.php 1 GET /zoo.php -- last 10 requests -- 20.48.250.41 - - [30/Aug/2026:02:53:23 +1000] "GET /init.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:24 +1000] "GET /term.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:24 +1000] "GET /aaa.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:25 +1000] "GET /xsox.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:25 +1000] "GET /lkui.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:26 +1000] "GET /wp-admin/css/colors/blue/about.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:26 +1000] "GET /motu.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:27 +1000] "GET /Ov-Simple1.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:27 +1000] "GET /wp-blogs.php HTTP/1.1" 404 5749 "-" "-" 20.48.250.41 - - [30/Aug/2026:02:53:28 +1000] "GET /mini.php HTTP/1.1" 404 5749 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.48.179.39 - - [30/Aug/2026:02:53:58 +1000] "GET /v22.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:53:58 +1000] "GET /wp-activate.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:53:59 +1000] "GET /wp-trackback.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:53:59 +1000] "GET /pri.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:53:59 +1000] "GET /wp_blog_footer.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:54:00 +1000] "GET /sushi.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:54:00 +1000] "GET /manga.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:54:01 +1000] "GET /asdfghj.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:54:01 +1000] "GET /dragonshell.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:54:02 +1000] "GET /wp-safe.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 02:51:33 L1=0.32 run=3 blk=0 avail=8640 (62.7%) swpO=0 conn=3 myRSS=2705 php=7 phpRSS=424 ap=16 tcp=33 topuser=alison 2026-08-30 02:51:43 L1=0.35 run=2 blk=0 avail=8812 (64.0%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=169 ap=17 tcp=27 topuser=madalice 2026-08-30 02:51:43 L1=0.35 run=3 blk=0 avail=8753 (63.5%) swpO=0 conn=3 myRSS=2705 php=6 phpRSS=313 ap=16 tcp=29 topuser=madalice 2026-08-30 02:51:53 L1=0.37 run=2 blk=0 avail=8812 (64.0%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=181 ap=16 tcp=28 topuser=alison 2026-08-30 02:51:54 L1=0.37 run=2 blk=0 avail=8871 (64.4%) swpO=0 conn=3 myRSS=2705 php=6 phpRSS=190 ap=16 tcp=31 topuser=evolution 2026-08-30 02:52:03 L1=0.61 run=3 blk=0 avail=8707 (63.2%) swpO=0 conn=2 myRSS=2705 php=4 phpRSS=288 ap=16 tcp=30 topuser=madalice 2026-08-30 02:52:04 L1=0.61 run=2 blk=0 avail=8771 (63.7%) swpO=0 conn=3 myRSS=2705 php=5 phpRSS=248 ap=16 tcp=32 topuser=madalice 2026-08-30 02:52:13 L1=0.76 run=3 blk=0 avail=8775 (63.7%) swpO=0 conn=2 myRSS=2705 php=4 phpRSS=224 ap=16 tcp=30 topuser=madalice 2026-08-30 02:52:14 L1=0.76 run=2 blk=0 avail=8668 (62.9%) swpO=0 conn=4 myRSS=2705 php=6 phpRSS=385 ap=16 tcp=35 topuser=alison 2026-08-30 02:52:23 L1=0.94 run=1 blk=0 avail=8777 (63.7%) swpO=1 conn=2 myRSS=2705 php=3 phpRSS=172 ap=22 tcp=28 topuser=madalice 2026-08-30 02:52:24 L1=0.94 run=4 blk=0 avail=8680 (63.0%) swpO=1 conn=4 myRSS=2705 php=6 phpRSS=359 ap=21 tcp=31 topuser=madalice 2026-08-30 02:52:33 L1=0.87 run=1 blk=0 avail=8814 (64.0%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=172 ap=17 tcp=28 topuser=madalice 2026-08-30 02:52:34 L1=0.87 run=2 blk=0 avail=8745 (63.5%) swpO=0 conn=4 myRSS=2705 php=6 phpRSS=325 ap=16 tcp=31 topuser=madalice 2026-08-30 02:52:43 L1=0.89 run=3 blk=0 avail=8744 (63.5%) swpO=0 conn=2 myRSS=2705 php=4 phpRSS=267 ap=16 tcp=30 topuser=alison 2026-08-30 02:52:44 L1=0.89 run=2 blk=0 avail=8682 (63.0%) swpO=0 conn=4 myRSS=2705 php=5 phpRSS=357 ap=16 tcp=30 topuser=madalice 2026-08-30 02:52:53 L1=0.83 run=2 blk=0 avail=8731 (63.4%) swpO=0 conn=2 myRSS=2705 php=4 phpRSS=270 ap=17 tcp=33 topuser=madalice 2026-08-30 02:52:54 L1=0.83 run=1 blk=0 avail=8780 (63.7%) swpO=0 conn=4 myRSS=2705 php=5 phpRSS=247 ap=17 tcp=33 topuser=madalice 2026-08-30 02:53:03 L1=0.86 run=6 blk=0 avail=8690 (63.1%) swpO=0 conn=2 myRSS=2705 php=5 phpRSS=343 ap=17 tcp=33 topuser=madalice 2026-08-30 02:53:04 L1=0.86 run=4 blk=0 avail=8492 (61.6%) swpO=0 conn=4 myRSS=2705 php=8 phpRSS=623 ap=17 tcp=37 topuser=olympic 2026-08-30 02:53:13 L1=1.03 run=2 blk=0 avail=8759 (63.6%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=169 ap=21 tcp=35 topuser=madalice 2026-08-30 02:53:14 L1=1.03 run=2 blk=0 avail=8685 (63.0%) swpO=0 conn=4 myRSS=2705 php=6 phpRSS=346 ap=20 tcp=36 topuser=madalice 2026-08-30 02:53:23 L1=1.18 run=2 blk=0 avail=8772 (63.7%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=169 ap=20 tcp=33 topuser=madalice 2026-08-30 02:53:24 L1=1.18 run=2 blk=0 avail=8711 (63.2%) swpO=0 conn=4 myRSS=2705 php=6 phpRSS=317 ap=20 tcp=36 topuser=madalice 2026-08-30 02:53:33 L1=1.15 run=3 blk=0 avail=8674 (63.0%) swpO=0 conn=2 myRSS=2705 php=4 phpRSS=296 ap=20 tcp=32 topuser=madalice 2026-08-30 02:53:34 L1=1.15 run=1 blk=0 avail=8755 (63.5%) swpO=2 conn=4 myRSS=2705 php=5 phpRSS=248 ap=20 tcp=35 topuser=madalice 2026-08-30 02:53:43 L1=1.14 run=2 blk=0 avail=8721 (63.3%) swpO=2 conn=2 myRSS=2705 php=5 phpRSS=305 ap=19 tcp=31 topuser=madalice 2026-08-30 02:53:44 L1=1.14 run=1 blk=0 avail=8776 (63.7%) swpO=1 conn=4 myRSS=2705 php=5 phpRSS=248 ap=18 tcp=31 topuser=madalice 2026-08-30 02:53:53 L1=0.96 run=6 blk=0 avail=8860 (64.3%) swpO=1 conn=3 myRSS=2705 php=4 phpRSS=143 ap=18 tcp=28 topuser=alison 2026-08-30 02:53:54 L1=0.96 run=5 blk=0 avail=8625 (62.6%) swpO=0 conn=4 myRSS=2705 php=8 phpRSS=498 ap=18 tcp=33 topuser=infinium 2026-08-30 02:54:03 L1=1.26 run=7 blk=0 avail=7580 (55.0%) swpO=0 conn=7 myRSS=2705 php=10 phpRSS=1529 ap=20 tcp=34 topuser=madalice