INCIDENT 2026-08-30 03:47:00 trigger: php_rss=2074MB mysql_conn=18 ================================================================== load: 1.79 1.19 0.87 18/680 2566338 ncpu:10 mem_avail: 7368MB/13777MB (53.5%) swap_used:1840MB swapout:0/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 20 procs / 2074MB heaviest user: customc (13 procs, 1291MB) apache: 24 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2694 customc 13 1621 root 257 1115 tubesupplies 3 471 nobody 23 408 netdata 7 198 evolution 12 193 madalice 1 132 mailman 20 127 cpanellogin 1 64 dovenull 6 45 lowrange 3 44 wp-toolkit 3 32 kurri 2 26 zabbix 1 21 dovecot 3 20 named 1 15 infinium 1 14 alison 1 14 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB customc 13 1678 tubesupplies 3 471 evolution 2 162 madalice 1 132 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5845 MB Active(file): 4629 MB Inactive(file): 1357 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 678 MB CommitLimit: 10984 MB Committed_AS: 9152 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-01:28:21 4236 /usr/bin/imunify-agent-proxy 2500104 root 17:00 3296 /bin/bash /etc/cron.daily/imunify-antivirus.cron 2500105 root 17:00 1348 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 2500106 root 17:00 9204 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 2500119 root 17:00 14552 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2759032 8.0 Ssl 2-01:27:50 /usr/sbin/mariadbd 2328310 2277352 root 181164 0.0 S 01:08:50 spamd child 508924 1 netdata 178052 1.9 Ssl 2-01:27:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.0 Ss 01:23:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2566297 2566127 customc 175640 72.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566300 2566216 customc 168760 68.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2328311 2277352 root 168468 0.0 S 01:08:50 spamd child 2566299 2566290 customc 167336 65.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2550241 2549922 tubesupplies 161036 1.1 S 01:58 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2549622 2533466 tubesupplies 161032 0.7 S 02:57 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2549870 2531942 tubesupplies 161020 0.9 S 02:23 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2566304 2566213 customc 160640 65.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566295 2566281 evolution 158992 34.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566306 2565644 customc 138644 57.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566133 510022 madalice 135976 6.1 S 00:21 php-fpm: pool madalice_com_au 509266 1 root 128576 0.0 Ss 2-01:27:16 /usr/lib/systemd/systemd-journald 2566305 2532590 customc 126900 47.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566301 2550101 customc 119752 41.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566307 2547599 customc 102592 34.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566302 2565626 customc 100572 81.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2566320 2566308 customc 77840 21.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2481080 1353308 cpanellogin 65720 0.0 S 25:35 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 55452 0.0 Sl 2-01:27:16 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43732 0.0 Sl 2-01:27:14 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42024 0.1 Ss 39-01:05:42 cpsrvd (SSL) - waiting for connections 2275833 1 root 36808 0.0 Ss 01:24:46 lfd - sleeping 1469 1 root 23760 0.1 Ss 61-17:37:11 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23528 0.0 Ss 2-01:27:12 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2547599 506832 nobody 23400 0.2 S 06:16 /usr/sbin/httpd -k start 483898 1 zabbix 22476 0.2 Ssl 2-01:28:33 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2550101 506832 nobody 22156 0.2 S 02:00 /usr/sbin/httpd -k start 2533466 506832 nobody 22088 0.0 S 07:20 /usr/sbin/httpd -k start 2564927 506832 nobody 22076 0.0 S 01:30 /usr/sbin/httpd -k start 2564476 506832 nobody 21912 0.0 S 01:33 /usr/sbin/httpd -k start 2531942 506832 nobody 21636 0.0 S 10:32 /usr/sbin/httpd -k start 2564635 506832 nobody 21436 0.2 S 01:31 /usr/sbin/httpd -k start 2565626 506832 nobody 21232 0.1 S 01:00 /usr/sbin/httpd -k start 1463 1 root 20344 0.0 Ss 61-17:37:11 tailwatchd 2532590 506832 nobody 20116 0.0 S 08:52 /usr/sbin/httpd -k start 2564917 506832 nobody 19724 0.0 S 01:30 /usr/sbin/httpd -k start 2533459 506832 nobody 19392 0.0 S 07:21 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 1-23:34:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2565644 506832 nobody 18608 0.0 S 00:59 /usr/sbin/httpd -k start 2549922 506832 nobody 18548 0.0 S 02:21 /usr/sbin/httpd -k start 2565643 506832 nobody 18448 0.4 S 00:59 /usr/sbin/httpd -k start 2566213 506832 nobody 17800 0.0 S 00:13 /usr/sbin/httpd -k start 2566215 506832 nobody 17640 0.0 S 00:12 /usr/sbin/httpd -k start 2566216 506832 nobody 17320 0.0 S 00:12 /usr/sbin/httpd -k start 2566127 506832 nobody 17072 0.0 S 00:22 /usr/sbin/httpd -k start 1471 1 root 16752 0.0 Ss 61-17:37:11 cPhulkd - processor 2566281 506832 nobody 16716 0.1 S 00:08 /usr/sbin/httpd -k start 2566290 506832 nobody 16468 0.0 S 00:04 /usr/sbin/httpd -k start 2566308 506832 nobody 16436 0.0 S 00:01 /usr/sbin/httpd -k start 2327413 1471 root 16392 0.0 S 01:10:42 cPhulkd - dbprocessor 509671 508992 netdata 15908 2.1 Sl 2-01:27:14 /usr/libexec/netdata/plugins.d/apps.plugin 1 2549457 508511 lowrange 15804 0.0 S 03:21 dovecot/pop3 508634 1 named 15700 0.0 Ssl 2-01:27:24 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1482727 508511 lowrange 15092 0.0 S 05:14:26 dovecot/imap 1876631 508511 infinium 14972 0.0 S 03:20:29 dovecot/imap 1742095 508511 lowrange 14756 0.0 S 04:00:08 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4309389 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1090 customc/customcentral.com.au-ssl_log 124 infinium/infinium.net.au-ssl_log 108 madalice/madalice.com.au-ssl_log 41 evolution/evolutionerp.com.au 30 evolution/evolutionerp.com.au-ssl_log 29 evolution/portal.evolutionerp.com.au-ssl_log 14 corpkicks/corporatekicks.com.au-ssl_log 7 aaa/aaadownunder.com.au-ssl_log 5 aaa/aaadownunder.com.au 4 alison/alisonarts.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 2 evolution/pdev.evolutionerp.com.au-ssl_log 2 tubesupplies/tubesupplies.com.au-ssl_log 2 corpkicks/2025.corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 16) --- top client IPs across all vhosts (last 3 min) --- 1090 40.115.94.245 108 198.54.114.50 70 158.23.184.117 59 20.220.10.235 51 34.12.253.143 38 20.48.250.41 12 203.54.180.238 8 118.127.40.55 7 141.98.11.42 5 195.178.110.223 2 35.189.199.76 2 216.73.216.122 2 185.221.182.74 2 114.119.130.40 1 74.125.210.196 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 95 GET /wp-login.php 15 POST /wp-login.php 12 GET /heartbeat.php 12 GET / 9 GET /api/getItem/NA 7 POST /wp-cron.php 4 GET /api/getItem/PWFBW3151KG 3 GET /store/custom-design-your-own-swoosh/ 3 GET /grsiuk.php 2 GET /ztv.php 2 GET /Zeiss.php 2 GET /ww2.php 2 GET /wp-content/uploads/2026/08/ 2 GET /wp-content/uploads/2026/07/ 2 GET /wp-admin/zwso.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC50NB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC6516 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC6565 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC7550 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC7575 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC90NB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC10050 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC1212 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC15050 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC16 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == customc/customcentral.com.au-ssl_log == -- top paths -- 7 GET / 3 POST /wp-cron.php 1 POST / 1 GET /ss.php 1 GET /sid3.php 1 GET /r.php 1 GET /root.php 1 GET /p.php 1 GET /php.php 1 GET /php8.php 1 GET /past.php 1 GET /oxshell.php -- last 10 requests -- 34.12.253.143 - - [30/Aug/2026:03:46:52 +1000] "GET /@fs/home/ubuntu/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 34.12.253.143 - - [30/Aug/2026:03:46:52 +1000] "GET /@fs/var/www/html/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko; compatible; Claude-Us 158.23.184.117 - - [30/Aug/2026:03:46:52 +1000] "GET /r.php HTTP/1.1" 404 15085 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 34.12.253.143 - - [30/Aug/2026:03:46:52 +1000] "GET /@fs/app/terraform.tfstate?raw?? HTTP/1.1" 404 73359 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.4; robots.txt; +https://openai 34.12.253.143 - - [30/Aug/2026:03:46:52 +1000] "GET /@fs/app/terraform.tfvars?raw?? HTTP/1.1" 404 73358 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 34.12.253.143 - - [30/Aug/2026:03:46:52 +1000] "GET /@fs/root/terraform.tfstate?raw?? HTTP/1.1" 404 73360 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Applebot/0.1; +http://www.apple.com/go/applebo 34.12.253.143 - - [30/Aug/2026:03:46:52 +1000] "GET /@fs/app/.terraform/terraform.tfstate?raw?? HTTP/1.1" 404 73371 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.4; robots.txt; +http 34.12.253.143 - - [30/Aug/2026:03:46:52 +1000] "GET /@fs/app/serverless.yml?raw?? HTTP/1.1" 404 73356 "-" "Mozilla/5.0 (compatible; TelegramBot/1.0)" 158.23.184.117 - - [30/Aug/2026:03:46:53 +1000] "GET /sid3.php HTTP/1.1" 404 15088 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:46:55 +1000] "GET /ss.php HTTP/1.1" 404 15085 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == infinium/infinium.net.au-ssl_log == -- top paths -- 94 GET /wp-login.php 14 POST /wp-login.php -- last 10 requests -- 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 198.54.114.50 - - [30/Aug/2026:03:45:31 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 03:44:38 L1=0.89 run=5 blk=0 avail=8480 (61.6%) swpO=2 conn=2 myRSS=2694 php=6 phpRSS=476 ap=18 tcp=35 topuser=tubesupplies 2026-08-30 03:44:39 L1=0.89 run=4 blk=0 avail=8361 (60.7%) swpO=2 conn=3 myRSS=2694 php=6 phpRSS=603 ap=18 tcp=35 topuser=tubesupplies 2026-08-30 03:44:49 L1=0.91 run=4 blk=0 avail=8300 (60.2%) swpO=0 conn=2 myRSS=2694 php=7 phpRSS=683 ap=19 tcp=35 topuser=tubesupplies 2026-08-30 03:44:49 L1=0.91 run=2 blk=0 avail=8337 (60.5%) swpO=0 conn=3 myRSS=2694 php=6 phpRSS=613 ap=19 tcp=35 topuser=tubesupplies 2026-08-30 03:44:59 L1=1.01 run=3 blk=0 avail=8307 (60.3%) swpO=0 conn=2 myRSS=2694 php=6 phpRSS=644 ap=19 tcp=34 topuser=tubesupplies 2026-08-30 03:44:59 L1=1.01 run=2 blk=0 avail=8404 (61.0%) swpO=0 conn=3 myRSS=2694 php=6 phpRSS=547 ap=19 tcp=33 topuser=tubesupplies 2026-08-30 03:45:09 L1=1.39 run=5 blk=0 avail=7957 (57.8%) swpO=0 conn=2 myRSS=2694 php=10 phpRSS=1090 ap=21 tcp=36 topuser=tubesupplies 2026-08-30 03:45:09 L1=1.39 run=8 blk=0 avail=7874 (57.2%) swpO=0 conn=8 myRSS=2694 php=10 phpRSS=1164 ap=21 tcp=37 topuser=tubesupplies 2026-08-30 03:45:19 L1=1.48 run=5 blk=0 avail=8094 (58.8%) swpO=0 conn=2 myRSS=2694 php=8 phpRSS=735 ap=21 tcp=31 topuser=tubesupplies 2026-08-30 03:45:19 L1=1.48 run=1 blk=0 avail=8243 (59.8%) swpO=0 conn=8 myRSS=2694 php=8 phpRSS=742 ap=21 tcp=31 topuser=tubesupplies 2026-08-30 03:45:29 L1=1.57 run=17 blk=0 avail=7475 (54.3%) swpO=0 conn=17 myRSS=2694 php=20 phpRSS=1901 ap=28 tcp=64 topuser=infinium 2026-08-30 03:45:29 L1=1.57 run=15 blk=0 avail=7240 (52.6%) swpO=0 conn=17 myRSS=2694 php=20 phpRSS=2057 ap=28 tcp=64 topuser=infinium 2026-08-30 03:45:39 L1=1.49 run=1 blk=0 avail=8084 (58.7%) swpO=0 conn=17 myRSS=2694 php=6 phpRSS=641 ap=45 tcp=32 topuser=tubesupplies 2026-08-30 03:45:40 L1=1.49 run=4 blk=0 avail=8019 (58.2%) swpO=0 conn=17 myRSS=2694 php=7 phpRSS=751 ap=44 tcp=31 topuser=tubesupplies 2026-08-30 03:45:49 L1=1.56 run=4 blk=0 avail=8224 (59.7%) swpO=2 conn=17 myRSS=2694 php=6 phpRSS=589 ap=35 tcp=35 topuser=tubesupplies 2026-08-30 03:45:50 L1=1.56 run=5 blk=0 avail=8168 (59.3%) swpO=2 conn=17 myRSS=2694 php=7 phpRSS=689 ap=34 tcp=34 topuser=tubesupplies 2026-08-30 03:45:59 L1=1.79 run=2 blk=0 avail=8158 (59.2%) swpO=2 conn=17 myRSS=2694 php=8 phpRSS=767 ap=26 tcp=34 topuser=tubesupplies 2026-08-30 03:46:00 L1=1.79 run=5 blk=0 avail=8082 (58.7%) swpO=2 conn=17 myRSS=2694 php=7 phpRSS=734 ap=26 tcp=33 topuser=tubesupplies 2026-08-30 03:46:09 L1=1.97 run=3 blk=0 avail=8204 (59.5%) swpO=0 conn=4 myRSS=2694 php=7 phpRSS=676 ap=31 tcp=32 topuser=tubesupplies 2026-08-30 03:46:10 L1=1.97 run=3 blk=0 avail=8139 (59.1%) swpO=0 conn=17 myRSS=2694 php=9 phpRSS=791 ap=31 tcp=29 topuser=tubesupplies 2026-08-30 03:46:19 L1=1.90 run=3 blk=0 avail=8184 (59.4%) swpO=0 conn=4 myRSS=2694 php=8 phpRSS=761 ap=25 tcp=31 topuser=tubesupplies 2026-08-30 03:46:20 L1=1.90 run=3 blk=0 avail=8034 (58.3%) swpO=0 conn=17 myRSS=2694 php=8 phpRSS=917 ap=25 tcp=30 topuser=tubesupplies 2026-08-30 03:46:29 L1=1.76 run=4 blk=0 avail=8042 (58.4%) swpO=0 conn=4 myRSS=2694 php=8 phpRSS=790 ap=21 tcp=29 topuser=tubesupplies 2026-08-30 03:46:30 L1=1.76 run=2 blk=0 avail=8140 (59.1%) swpO=0 conn=5 myRSS=2694 php=7 phpRSS=814 ap=21 tcp=29 topuser=tubesupplies 2026-08-30 03:46:39 L1=1.72 run=5 blk=0 avail=7966 (57.8%) swpO=0 conn=4 myRSS=2694 php=10 phpRSS=960 ap=22 tcp=31 topuser=tubesupplies 2026-08-30 03:46:40 L1=1.72 run=5 blk=0 avail=7835 (56.9%) swpO=0 conn=5 myRSS=2694 php=11 phpRSS=1242 ap=22 tcp=33 topuser=tubesupplies 2026-08-30 03:46:49 L1=1.85 run=2 blk=0 avail=8148 (59.1%) swpO=0 conn=4 myRSS=2694 php=7 phpRSS=783 ap=28 tcp=26 topuser=tubesupplies 2026-08-30 03:46:50 L1=1.85 run=3 blk=0 avail=8178 (59.4%) swpO=0 conn=5 myRSS=2694 php=8 phpRSS=781 ap=28 tcp=26 topuser=tubesupplies 2026-08-30 03:47:00 L1=1.79 run=15 blk=0 avail=7368 (53.5%) swpO=0 conn=18 myRSS=2694 php=20 phpRSS=2074 ap=24 tcp=58 topuser=customc 2026-08-30 03:47:00 L1=1.79 run=19 blk=0 avail=6659 (48.3%) swpO=0 conn=15 myRSS=2694 php=17 phpRSS=2148 ap=24 tcp=58 topuser=customc