INCIDENT 2026-08-30 03:48:01 trigger: php_rss=2657MB mysql_conn=15 ================================================================== load: 3.17 1.70 1.07 17/689 2567595 ncpu:10 mem_avail: 6410MB/13777MB (46.5%) swap_used:1843MB swapout:0/s blocked(D):0 running:20 iowait:0.0% steal:0.0% php: 20 procs / 2657MB heaviest user: customc (14 procs, 1995MB) apache: 36 procs tcp_estab: 53 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2691 customc 11 1627 root 256 1116 nobody 35 582 tubesupplies 3 471 netdata 7 197 madalice 1 154 mailman 20 127 cpanellogin 1 64 dovenull 6 45 lowrange 3 44 evolution 11 44 wp-toolkit 3 32 kurri 2 26 zabbix 1 22 dovecot 3 20 named 1 15 mailnull 2 15 infinium 1 14 alison 1 14 --- php workers by user --- USER PROCS RSS_MB customc 9 1363 tubesupplies 3 471 madalice 1 154 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5412 MB Active(file): 4505 MB Inactive(file): 987 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 647 MB CommitLimit: 10984 MB Committed_AS: 9007 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-01:29:22 4236 /usr/bin/imunify-agent-proxy 2500104 root 18:01 3296 /bin/bash /etc/cron.daily/imunify-antivirus.cron 2500105 root 18:01 1348 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 2500106 root 18:01 9204 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 2500119 root 18:01 14552 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2756168 8.0 Ssl 2-01:28:51 /usr/sbin/mariadbd 2567564 2567434 customc 187408 39.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2328310 2277352 root 181164 0.0 S 01:09:51 spamd child 508924 1 netdata 176968 1.9 Ssl 2-01:28:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.0 Ss 01:24:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168456 0.0 S 01:09:51 spamd child 2567553 2566991 customc 164884 38.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2550241 2549922 tubesupplies 161036 0.7 S 02:59 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2549622 2533466 tubesupplies 161032 0.5 S 03:58 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2549870 2531942 tubesupplies 161020 0.6 S 03:24 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2567557 2567450 customc 160680 37.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2567548 2567466 customc 158452 34.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2567287 510022 madalice 158220 8.9 S 00:30 php-fpm: pool madalice_com_au 2567562 2567232 customc 151040 31.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2567549 2567468 customc 136016 42.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 509266 1 root 128956 0.0 Ss 2-01:28:17 /usr/lib/systemd/systemd-journald 2481080 1353308 cpanellogin 65720 0.0 S 26:36 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 55452 0.0 Sl 2-01:28:17 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43728 0.0 Sl 2-01:28:15 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42024 0.1 Ss 39-01:06:43 cpsrvd (SSL) - waiting for connections 2275833 1 root 36808 0.0 Ss 01:25:47 lfd - sleeping 2567545 2567002 customc 28028 43.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1469 1 root 23732 0.1 Ss 61-17:38:12 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23528 0.0 Ss 2-01:28:13 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2547599 506832 nobody 23404 0.2 S 07:17 /usr/sbin/httpd -k start 2565626 506832 nobody 22876 0.0 S 02:01 /usr/sbin/httpd -k start 483898 1 zabbix 22592 0.2 Ssl 2-01:29:34 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2533466 506832 nobody 22088 0.0 S 08:21 /usr/sbin/httpd -k start 2531942 506832 nobody 21636 0.0 S 11:33 /usr/sbin/httpd -k start 1463 1 root 20344 0.0 Ss 61-17:38:12 tailwatchd 2566991 506832 nobody 19616 0.0 S 00:59 /usr/sbin/httpd -k start 2567002 506832 nobody 19396 0.0 S 00:58 /usr/sbin/httpd -k start 2566976 506832 nobody 18948 0.0 S 01:00 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 1-23:35:54 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2566215 506832 nobody 18620 0.0 S 01:13 /usr/sbin/httpd -k start 2549922 506832 nobody 18548 0.0 S 03:22 /usr/sbin/httpd -k start 2566989 506832 nobody 18392 0.0 S 00:59 /usr/sbin/httpd -k start 2567235 506832 nobody 17932 0.0 S 00:31 /usr/sbin/httpd -k start 2566216 506832 nobody 17880 0.0 S 01:13 /usr/sbin/httpd -k start 2566997 506832 nobody 17732 0.0 S 00:58 /usr/sbin/httpd -k start 2567451 506832 nobody 17144 0.0 S 00:15 /usr/sbin/httpd -k start 2567009 506832 nobody 17120 0.0 S 00:58 /usr/sbin/httpd -k start 2567233 506832 nobody 17096 0.0 S 00:31 /usr/sbin/httpd -k start 2567232 506832 nobody 17076 0.0 S 00:31 /usr/sbin/httpd -k start 2567317 506832 nobody 17048 0.2 S 00:25 /usr/sbin/httpd -k start 2567426 506832 nobody 16876 0.0 S 00:17 /usr/sbin/httpd -k start 2567435 506832 nobody 16876 0.0 S 00:16 /usr/sbin/httpd -k start 2567450 506832 nobody 16824 0.0 S 00:15 /usr/sbin/httpd -k start 2567448 506832 nobody 16792 0.0 S 00:15 /usr/sbin/httpd -k start 2567468 506832 nobody 16788 0.0 S 00:14 /usr/sbin/httpd -k start 2567466 506832 nobody 16764 0.0 S 00:14 /usr/sbin/httpd -k start 2567463 506832 nobody 16760 0.0 S 00:14 /usr/sbin/httpd -k start 2567470 506832 nobody 16740 0.0 S 00:14 /usr/sbin/httpd -k start 2567469 506832 nobody 16732 0.0 S 00:14 /usr/sbin/httpd -k start 1471 1 root 16728 0.0 Ss 61-17:38:12 cPhulkd - processor 2567434 506832 nobody 16720 0.0 S 00:16 /usr/sbin/httpd -k start 2567449 506832 nobody 16704 0.0 S 00:15 /usr/sbin/httpd -k start 2567234 506832 nobody 16468 0.0 R 00:31 /usr/sbin/httpd -k start 2327413 1471 root 16384 0.0 S 01:11:43 cPhulkd - dbprocessor 509671 508992 netdata 15904 2.1 Sl 2-01:28:15 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4309615 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 287 evolution/app.evolutionerp.com.au-ssl_log 228 candyfabcom/candyfab.com.au-ssl_log 57 aaa/aaadownunder.com.au-ssl_log 18 evolution/portal.evolutionerp.com.au-ssl_log 12 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 228 40.115.94.245 202 34.12.253.143 126 158.23.184.117 12 203.54.180.238 10 118.127.40.55 9 141.98.11.42 6 158.173.67.217 4 199.188.200.14 2 131.226.2.219 1 50.6.207.27 1 45.148.10.120 1 195.178.110.223 --- top request paths across all vhosts (last 3 min) --- 124 GET /api/getItem/LWFBW2001KG 13 GET / 12 GET /heartbeat.php 7 POST / 7 GET /wp-login.php 3 POST /wp-login.php 3 POST /wp-cron.php 2 GET /xmlrpc.php 2 GET /wp.php 2 GET /wp-admin/maint/ 2 GET /wp-admin/includes/ 2 GET /new.php 2 GET /@fs/proc/self/environ 2 GET /fff.php 2 GET /api/getItem/IPC2525 2 GET /api/getItem/GEB12-DL 1 GET /.zsh_history 1 GET /y.php 1 GET /xx.php 1 GET /x.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 7 POST / 6 GET / 3 GET /wp-login.php 2 POST /wp-cron.php 2 GET /@fs/proc/self/environ 1 GET /.zsh_history 1 GET /y.php 1 GET /xx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /ws.php 1 GET /wsa.php -- last 10 requests -- 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /.env.openai HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthr 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /app/.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Mobile/15E148 Safari/ 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /config.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot)" 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /.env.docker HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-SearchBot/1.0; +https://develo 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /secrets.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15; compatible; Cla 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /sendgrid.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /.env.vault HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; WhatsApp/10.0.2.1) Chrome/131.0.8479.212 Sa 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /.github/workflows/deploy.yml HTTP/1.1" 404 73358 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.2309.208 Safari/537.36 Edg/85. 34.12.253.143 - - [30/Aug/2026:03:47:59 +1000] "GET /.flaskenv HTTP/1.1" 404 73337 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 50.6.207.27 - - [30/Aug/2026:03:47:59 +1000] "GET /wp-login.php HTTP/1.1" 200 1926 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 124 GET /api/getItem/LWFBW2001KG 2 GET /api/getItem/IPC2525 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/SGC-100 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC50NB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC6516 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC6565 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC7550 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC7575 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/IPC90NB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC10050 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC1212 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC15050 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:46:15 +1000] "GET /api/getItem/PC16 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 7 GET / 1 GET /xmr.php 1 GET /xmlrpc.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/theme-compat 1 GET /wp-includes/Text.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Test.php 1 GET /wp-includes/style-engine/wp-conflg.php 1 GET /wp-includes/Requests/Exception/file.php 1 GET /wp-includes/pomo.php -- last 10 requests -- 158.23.184.117 - - [30/Aug/2026:03:47:46 +1000] "GET /app.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:46 +1000] "GET /aaa.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:46 +1000] "GET /wp-includes/IXR HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:46 +1000] "GET /hehe.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:47 +1000] "GET /wp-includes/PHPMailer.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:47 +1000] "GET /wp-content/upgrade/alfanew.php7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 158.23.184.117 - - [30/Aug/2026:03:47:47 +1000] "GET /admin/alfa-rex.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:47 +1000] "GET /wp-content/export.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:47 +1000] "GET /new.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:03:47:48 +1000] "GET /wp-content/plugins/revslider/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar --- last 30 samples (run-up to this incident) --- 2026-08-30 03:45:39 L1=1.49 run=1 blk=0 avail=8084 (58.7%) swpO=0 conn=17 myRSS=2694 php=6 phpRSS=641 ap=45 tcp=32 topuser=tubesupplies 2026-08-30 03:45:40 L1=1.49 run=4 blk=0 avail=8019 (58.2%) swpO=0 conn=17 myRSS=2694 php=7 phpRSS=751 ap=44 tcp=31 topuser=tubesupplies 2026-08-30 03:45:49 L1=1.56 run=4 blk=0 avail=8224 (59.7%) swpO=2 conn=17 myRSS=2694 php=6 phpRSS=589 ap=35 tcp=35 topuser=tubesupplies 2026-08-30 03:45:50 L1=1.56 run=5 blk=0 avail=8168 (59.3%) swpO=2 conn=17 myRSS=2694 php=7 phpRSS=689 ap=34 tcp=34 topuser=tubesupplies 2026-08-30 03:45:59 L1=1.79 run=2 blk=0 avail=8158 (59.2%) swpO=2 conn=17 myRSS=2694 php=8 phpRSS=767 ap=26 tcp=34 topuser=tubesupplies 2026-08-30 03:46:00 L1=1.79 run=5 blk=0 avail=8082 (58.7%) swpO=2 conn=17 myRSS=2694 php=7 phpRSS=734 ap=26 tcp=33 topuser=tubesupplies 2026-08-30 03:46:09 L1=1.97 run=3 blk=0 avail=8204 (59.5%) swpO=0 conn=4 myRSS=2694 php=7 phpRSS=676 ap=31 tcp=32 topuser=tubesupplies 2026-08-30 03:46:10 L1=1.97 run=3 blk=0 avail=8139 (59.1%) swpO=0 conn=17 myRSS=2694 php=9 phpRSS=791 ap=31 tcp=29 topuser=tubesupplies 2026-08-30 03:46:19 L1=1.90 run=3 blk=0 avail=8184 (59.4%) swpO=0 conn=4 myRSS=2694 php=8 phpRSS=761 ap=25 tcp=31 topuser=tubesupplies 2026-08-30 03:46:20 L1=1.90 run=3 blk=0 avail=8034 (58.3%) swpO=0 conn=17 myRSS=2694 php=8 phpRSS=917 ap=25 tcp=30 topuser=tubesupplies 2026-08-30 03:46:29 L1=1.76 run=4 blk=0 avail=8042 (58.4%) swpO=0 conn=4 myRSS=2694 php=8 phpRSS=790 ap=21 tcp=29 topuser=tubesupplies 2026-08-30 03:46:30 L1=1.76 run=2 blk=0 avail=8140 (59.1%) swpO=0 conn=5 myRSS=2694 php=7 phpRSS=814 ap=21 tcp=29 topuser=tubesupplies 2026-08-30 03:46:39 L1=1.72 run=5 blk=0 avail=7966 (57.8%) swpO=0 conn=4 myRSS=2694 php=10 phpRSS=960 ap=22 tcp=31 topuser=tubesupplies 2026-08-30 03:46:40 L1=1.72 run=5 blk=0 avail=7835 (56.9%) swpO=0 conn=5 myRSS=2694 php=11 phpRSS=1242 ap=22 tcp=33 topuser=tubesupplies 2026-08-30 03:46:49 L1=1.85 run=2 blk=0 avail=8148 (59.1%) swpO=0 conn=4 myRSS=2694 php=7 phpRSS=783 ap=28 tcp=26 topuser=tubesupplies 2026-08-30 03:46:50 L1=1.85 run=3 blk=0 avail=8178 (59.4%) swpO=0 conn=5 myRSS=2694 php=8 phpRSS=781 ap=28 tcp=26 topuser=tubesupplies 2026-08-30 03:47:00 L1=1.79 run=15 blk=0 avail=7368 (53.5%) swpO=0 conn=18 myRSS=2694 php=20 phpRSS=2074 ap=24 tcp=58 topuser=customc 2026-08-30 03:47:00 L1=1.79 run=19 blk=0 avail=6659 (48.3%) swpO=0 conn=15 myRSS=2694 php=17 phpRSS=2148 ap=24 tcp=58 topuser=customc 2026-08-30 03:47:10 L1=2.70 run=3 blk=0 avail=7718 (56.0%) swpO=1 conn=15 myRSS=2694 php=8 phpRSS=1054 ap=49 tcp=32 topuser=tubesupplies 2026-08-30 03:47:11 L1=2.70 run=3 blk=0 avail=7926 (57.5%) swpO=1 conn=5 myRSS=2694 php=7 phpRSS=731 ap=48 tcp=29 topuser=tubesupplies 2026-08-30 03:47:20 L1=2.29 run=13 blk=0 avail=7470 (54.2%) swpO=2 conn=15 myRSS=2694 php=17 phpRSS=1710 ap=40 tcp=47 topuser=customc 2026-08-30 03:47:21 L1=2.29 run=18 blk=0 avail=6677 (48.5%) swpO=2 conn=10 myRSS=2694 php=17 phpRSS=2231 ap=40 tcp=41 topuser=customc 2026-08-30 03:47:31 L1=2.01 run=4 blk=0 avail=7870 (57.1%) swpO=65 conn=6 myRSS=2691 php=8 phpRSS=969 ap=39 tcp=62 topuser=tubesupplies 2026-08-30 03:47:31 L1=2.01 run=1 blk=0 avail=8237 (59.8%) swpO=72 conn=10 myRSS=2691 php=5 phpRSS=507 ap=39 tcp=56 topuser=tubesupplies 2026-08-30 03:47:41 L1=2.98 run=1 blk=0 avail=8172 (59.3%) swpO=0 conn=6 myRSS=2691 php=6 phpRSS=640 ap=33 tcp=30 topuser=tubesupplies 2026-08-30 03:47:41 L1=2.98 run=1 blk=0 avail=8172 (59.3%) swpO=0 conn=10 myRSS=2691 php=6 phpRSS=640 ap=33 tcp=30 topuser=tubesupplies 2026-08-30 03:47:51 L1=3.40 run=2 blk=0 avail=8112 (58.9%) swpO=0 conn=6 myRSS=2691 php=7 phpRSS=674 ap=42 tcp=31 topuser=tubesupplies 2026-08-30 03:47:51 L1=3.40 run=4 blk=0 avail=7974 (57.9%) swpO=0 conn=10 myRSS=2691 php=8 phpRSS=842 ap=42 tcp=30 topuser=tubesupplies 2026-08-30 03:48:01 L1=3.17 run=20 blk=0 avail=6410 (46.5%) swpO=0 conn=15 myRSS=2691 php=20 phpRSS=2657 ap=36 tcp=53 topuser=customc 2026-08-30 03:48:01 L1=3.17 run=10 blk=0 avail=7525 (54.6%) swpO=0 conn=10 myRSS=2691 php=10 phpRSS=1381 ap=36 tcp=48 topuser=customc