INCIDENT 2026-08-30 12:21:34 trigger: php_procs=26 ================================================================== load: 1.59 1.09 0.89 21/671 121263 ncpu:10 mem_avail: 7848MB/13777MB (57.0%) swap_used:1825MB swapout:0/s blocked(D):0 running:28 iowait:0.0% steal:0.0% php: 26 procs / 1091MB heaviest user: infinium (19 procs, 705MB) apache: 47 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2924 root 241 1106 nobody 44 833 infinium 10 425 madalice 2 226 netdata 7 195 mailman 20 121 evolution 7 102 cpanellogin 1 63 tubesupplies 1 58 dovenull 6 46 mailnull 2 45 wp-toolkit 3 31 kurri 2 27 zabbix 1 20 dovecot 3 19 named 1 15 alison 1 13 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 2 232 infinium 6 223 evolution 3 93 tubesupplies 1 59 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5128 MB Active(file): 4634 MB Inactive(file): 908 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 601 MB CommitLimit: 10984 MB Committed_AS: 8140 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-10:02:55 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2995164 7.3 Ssl 2-10:02:24 /usr/sbin/mariadbd 2328310 2277352 root 208640 0.0 S 09:43:24 spamd child 508924 1 netdata 175712 1.9 Ssl 2-10:01:53 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175488 0.0 Ss 09:58:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 165788 0.0 S 09:43:24 spamd child 509266 1 root 147996 0.0 Ss 2-10:01:50 /usr/lib/systemd/systemd-journald 121019 510022 madalice 143972 8.8 R 00:19 php-fpm: pool madalice_com_au 121201 510022 madalice 104748 45.0 R 00:01 php-fpm: pool madalice_com_au 4027958 1353308 cpanellogin 65196 0.0 S 01:23:21 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 121206 121130 tubesupplies 64716 30.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 53032 0.0 Sl 2-10:01:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 48628 0.0 Sl 2-10:01:48 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42480 0.1 Ss 39-09:40:16 cpsrvd (SSL) - waiting for connections 121198 104778 evolution 41680 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 121199 121177 evolution 40568 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 121315 121134 infinium 39416 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 121319 121136 infinium 37752 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2275833 1 root 35924 0.0 Ss 09:59:20 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-10:01:57 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24028 0.1 Ss 62-02:11:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23344 0.0 Ss 2-10:01:46 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 104769 506832 nobody 22872 0.0 S 04:13 /usr/sbin/httpd -k start 104740 506832 nobody 22308 0.0 S 04:14 /usr/sbin/httpd -k start 104784 506832 nobody 22148 0.0 S 04:13 /usr/sbin/httpd -k start 104775 506832 nobody 22140 0.0 S 04:13 /usr/sbin/httpd -k start 1463 1 root 21968 0.0 Ss 62-02:11:45 tailwatchd 104778 506832 nobody 21660 0.0 S 04:13 /usr/sbin/httpd -k start 104722 506832 nobody 21460 0.0 S 04:14 /usr/sbin/httpd -k start 104746 506832 nobody 21396 0.0 S 04:14 /usr/sbin/httpd -k start 104811 506832 nobody 21200 0.0 S 04:12 /usr/sbin/httpd -k start 121086 506832 nobody 21148 0.6 S 00:05 /usr/sbin/httpd -k start 106575 506832 nobody 21096 0.0 S 01:46 /usr/sbin/httpd -k start 104689 506832 nobody 21076 0.0 S 04:18 /usr/sbin/httpd -k start 121096 506832 nobody 21068 0.5 S 00:04 /usr/sbin/httpd -k start 121110 506832 nobody 21052 0.6 S 00:03 /usr/sbin/httpd -k start 121111 506832 nobody 21028 1.0 S 00:03 /usr/sbin/httpd -k start 483898 1 zabbix 21028 0.2 Ssl 2-10:03:07 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 121108 506832 nobody 21000 1.0 S 00:03 /usr/sbin/httpd -k start 121109 506832 nobody 20960 1.0 S 00:03 /usr/sbin/httpd -k start 106507 508720 mailnull 20940 0.0 S 01:52 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 121132 506832 nobody 20940 0.5 S 00:02 /usr/sbin/httpd -k start 121095 506832 nobody 20920 0.7 S 00:04 /usr/sbin/httpd -k start 121131 506832 nobody 20908 1.0 S 00:02 /usr/sbin/httpd -k start 121137 506832 nobody 20908 1.0 S 00:02 /usr/sbin/httpd -k start 121135 506832 nobody 20716 0.5 S 00:02 /usr/sbin/httpd -k start 120636 506832 nobody 20544 0.0 S 01:01 /usr/sbin/httpd -k start 121134 506832 nobody 20020 0.5 S 00:02 /usr/sbin/httpd -k start 121133 506832 nobody 19996 1.0 S 00:02 /usr/sbin/httpd -k start 121136 506832 nobody 19856 0.5 S 00:02 /usr/sbin/httpd -k start 121130 506832 nobody 19784 1.0 S 00:02 /usr/sbin/httpd -k start 121172 506832 nobody 19632 0.0 S 00:01 /usr/sbin/httpd -k start 121175 506832 nobody 19592 1.0 S 00:01 /usr/sbin/httpd -k start 121174 506832 nobody 19568 0.0 S 00:01 /usr/sbin/httpd -k start 121178 506832 nobody 19544 1.0 S 00:01 /usr/sbin/httpd -k start 121187 506832 nobody 19544 0.0 S 00:01 /usr/sbin/httpd -k start 121182 506832 nobody 19540 1.0 S 00:01 /usr/sbin/httpd -k start 121184 506832 nobody 19540 0.0 S 00:01 /usr/sbin/httpd -k start 121185 506832 nobody 19540 0.0 S 00:01 /usr/sbin/httpd -k start 121179 506832 nobody 19484 1.0 S 00:01 /usr/sbin/httpd -k start 121181 506832 nobody 19484 1.0 S 00:01 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4501372 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min infinium/infinium.net.au-ssl_log 117 tubesupplies/tubesupplies.com.au-ssl_log 85 bigdeals/bigdeals.com.au-ssl_log 80 evolution/portal.evolutionerp.com.au-ssl_log 28 alison/alisonarts.com.au-ssl_log 2 madalice/madalice.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 110 195.85.207.182 81 34.175.89.173 80 52.139.37.240 28 203.54.180.238 4 118.127.40.55 2 66.116.251.167 2 162.241.203.42 2 103.255.250.10 1 91.92.243.251 1 85.208.96.210 1 185.191.171.19 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 80 GET /wp-login.php 28 GET /heartbeat.php 23 GET /wp-json/wp/v2/users/me 14 POST /wp-login.php 4 POST /wp-cron.php 3 POST / 3 GET /@fs/proc/self/environ 3 GET /@fs/proc/self/cwd/.env.production 3 GET /@fs/proc/self/cwd/.env.local 3 GET /@fs/proc/self/cwd/.env 3 GET /@fs/etc/passwd 3 GET / 2 GET /.env.save 2 GET /.env.old 2 GET /.env.bak 2 GET /.env.backup 1 GET /xl.php 1 GET /www.zip 1 GET /www/.env 1 GET /ws.php --- busiest 3 vhosts: top paths + last 10 requests --- == infinium/infinium.net.au-ssl_log == -- top paths -- 79 GET /wp-login.php 23 GET /wp-json/wp/v2/users/me 13 POST /wp-login.php 2 POST /wp-cron.php -- last 10 requests -- 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 195.85.207.182 - - [30/Aug/2026:12:21:34 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 3 POST / 3 GET /@fs/proc/self/environ 3 GET /@fs/proc/self/cwd/.env.production 3 GET /@fs/proc/self/cwd/.env.local 3 GET /@fs/proc/self/cwd/.env 3 GET /@fs/etc/passwd 3 GET / 2 POST /wp-cron.php 2 GET /.env.save 2 GET /.env.old 2 GET /.env.bak 2 GET /.env.backup -- last 10 requests -- 34.175.89.173 - - [30/Aug/2026:12:20:40 +1000] "GET /@fs/proc/self/environ HTTP/1.1" 404 152149 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:12:20:43 +1000] "GET /@fs/proc/self/environ?raw HTTP/1.1" 404 152148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537. 34.175.89.173 - - [30/Aug/2026:12:20:45 +1000] "GET /@fs/proc/self/environ?import&raw HTTP/1.1" 404 152155 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safa 34.175.89.173 - - [30/Aug/2026:12:20:48 +1000] "GET /@fs/etc/passwd HTTP/1.1" 404 152143 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:12:20:50 +1000] "GET /@fs/etc/passwd?raw HTTP/1.1" 404 152152 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:12:20:53 +1000] "GET /@fs/etc/passwd?import&raw HTTP/1.1" 404 152151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537. 34.175.89.173 - - [30/Aug/2026:12:20:55 +1000] "GET / HTTP/1.1" 301 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 118.127.40.55 - - [30/Aug/2026:12:20:56 +1000] "POST /wp-cron.php?doing_wp_cron=1788056456.7610800266265869140625 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://tubesupplies.com.au" 34.175.89.173 - - [30/Aug/2026:12:20:58 +1000] "GET /_ignition/health-check HTTP/1.1" 404 152148 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:12:21:00 +1000] "GET /admin HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 1 GET /xl.php 1 GET /ws.php 1 GET /wso.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/index.php 1 GET /wp-includes/SimplePie/gzdecodes.php 1 GET /wp-includes/rest-api/about.php 1 GET /wp-includes/js/tinymce/skins/lightgray/img/index.php 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/index.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:12:19:45 +1000] "GET /.well-known/classwithtostring.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [30/Aug/2026:12:19:45 +1000] "GET /wp-admin/js/about.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:19:46 +1000] "GET /comfunctions.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:19:46 +1000] "GET /images/class-config.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:19:47 +1000] "GET /wp-includes/widgets/include.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:19:48 +1000] "GET /install.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:19:48 +1000] "GET /.well-known/file.php/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:19:49 +1000] "GET /wp-includes/SimplePie/gzdecodes.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 52.139.37.240 - - [30/Aug/2026:12:19:49 +1000] "GET /wp-back.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:19:50 +1000] "GET /wp-admin/css/colors/blue/about.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 --- last 30 samples (run-up to this incident) --- 2026-08-30 12:19:04 L1=1.22 run=2 blk=0 avail=6853 (49.7%) swpO=0 conn=2 myRSS=2924 php=13 phpRSS=1710 ap=46 tcp=25 topuser=madalice 2026-08-30 12:19:13 L1=1.11 run=1 blk=0 avail=7000 (50.8%) swpO=0 conn=1 myRSS=2924 php=12 phpRSS=1593 ap=38 tcp=25 topuser=madalice 2026-08-30 12:19:14 L1=1.11 run=3 blk=0 avail=6988 (50.7%) swpO=0 conn=3 myRSS=2924 php=13 phpRSS=1652 ap=36 tcp=28 topuser=madalice 2026-08-30 12:19:23 L1=1.10 run=3 blk=0 avail=7751 (56.3%) swpO=0 conn=1 myRSS=2924 php=10 phpRSS=795 ap=27 tcp=32 topuser=madalice 2026-08-30 12:19:24 L1=1.10 run=1 blk=0 avail=8016 (58.2%) swpO=0 conn=3 myRSS=2924 php=5 phpRSS=503 ap=26 tcp=31 topuser=madalice 2026-08-30 12:19:33 L1=1.09 run=4 blk=0 avail=7912 (57.4%) swpO=0 conn=1 myRSS=2924 php=9 phpRSS=792 ap=17 tcp=27 topuser=madalice 2026-08-30 12:19:34 L1=1.09 run=4 blk=0 avail=8021 (58.2%) swpO=0 conn=3 myRSS=2924 php=7 phpRSS=627 ap=17 tcp=27 topuser=madalice 2026-08-30 12:19:43 L1=1.08 run=1 blk=0 avail=8467 (61.5%) swpO=0 conn=3 myRSS=2924 php=4 phpRSS=116 ap=17 tcp=27 topuser=evolution 2026-08-30 12:19:44 L1=1.08 run=2 blk=0 avail=8453 (61.4%) swpO=0 conn=3 myRSS=2924 php=3 phpRSS=101 ap=17 tcp=28 topuser=tubesupplies 2026-08-30 12:19:53 L1=1.14 run=3 blk=0 avail=8222 (59.7%) swpO=0 conn=3 myRSS=2924 php=7 phpRSS=434 ap=18 tcp=34 topuser=infinium 2026-08-30 12:19:55 L1=1.14 run=3 blk=0 avail=8306 (60.3%) swpO=0 conn=3 myRSS=2924 php=5 phpRSS=294 ap=18 tcp=30 topuser=madalice 2026-08-30 12:20:03 L1=1.28 run=2 blk=0 avail=8326 (60.4%) swpO=0 conn=3 myRSS=2924 php=5 phpRSS=270 ap=18 tcp=26 topuser=madalice 2026-08-30 12:20:05 L1=1.28 run=3 blk=0 avail=8340 (60.5%) swpO=0 conn=2 myRSS=2924 php=4 phpRSS=238 ap=18 tcp=29 topuser=madalice 2026-08-30 12:20:14 L1=1.46 run=2 blk=0 avail=8238 (59.8%) swpO=0 conn=3 myRSS=2924 php=6 phpRSS=401 ap=19 tcp=29 topuser=madalice 2026-08-30 12:20:15 L1=1.46 run=2 blk=0 avail=8336 (60.5%) swpO=0 conn=2 myRSS=2924 php=4 phpRSS=252 ap=18 tcp=27 topuser=madalice 2026-08-30 12:20:24 L1=1.24 run=4 blk=0 avail=8264 (60.0%) swpO=0 conn=3 myRSS=2924 php=7 phpRSS=403 ap=17 tcp=30 topuser=madalice 2026-08-30 12:20:25 L1=1.24 run=1 blk=0 avail=8370 (60.8%) swpO=0 conn=2 myRSS=2924 php=3 phpRSS=191 ap=17 tcp=30 topuser=madalice 2026-08-30 12:20:34 L1=1.28 run=7 blk=0 avail=8101 (58.8%) swpO=0 conn=3 myRSS=2924 php=9 phpRSS=638 ap=18 tcp=31 topuser=tubesupplies 2026-08-30 12:20:35 L1=1.28 run=5 blk=0 avail=8186 (59.4%) swpO=0 conn=2 myRSS=2924 php=6 phpRSS=470 ap=18 tcp=28 topuser=tubesupplies 2026-08-30 12:20:44 L1=1.40 run=2 blk=0 avail=8234 (59.8%) swpO=0 conn=4 myRSS=2924 php=6 phpRSS=412 ap=18 tcp=25 topuser=madalice 2026-08-30 12:20:45 L1=1.40 run=2 blk=0 avail=8406 (61.0%) swpO=0 conn=2 myRSS=2924 php=3 phpRSS=150 ap=18 tcp=26 topuser=madalice 2026-08-30 12:20:54 L1=1.18 run=2 blk=0 avail=8281 (60.1%) swpO=0 conn=4 myRSS=2924 php=6 phpRSS=372 ap=17 tcp=28 topuser=madalice 2026-08-30 12:20:55 L1=1.18 run=1 blk=0 avail=8397 (61.0%) swpO=0 conn=2 myRSS=2924 php=3 phpRSS=168 ap=17 tcp=26 topuser=madalice 2026-08-30 12:21:04 L1=1.07 run=2 blk=0 avail=8299 (60.2%) swpO=0 conn=4 myRSS=2924 php=6 phpRSS=361 ap=15 tcp=27 topuser=madalice 2026-08-30 12:21:05 L1=1.07 run=4 blk=0 avail=8349 (60.6%) swpO=0 conn=2 myRSS=2924 php=4 phpRSS=253 ap=15 tcp=27 topuser=madalice 2026-08-30 12:21:14 L1=0.91 run=2 blk=0 avail=8463 (61.4%) swpO=0 conn=4 myRSS=2924 php=5 phpRSS=183 ap=14 tcp=24 topuser=evolution 2026-08-30 12:21:15 L1=0.91 run=1 blk=0 avail=8529 (61.9%) swpO=0 conn=2 myRSS=2924 php=2 phpRSS=35 ap=14 tcp=22 topuser=root 2026-08-30 12:21:24 L1=0.84 run=1 blk=0 avail=8395 (60.9%) swpO=0 conn=4 myRSS=2924 php=5 phpRSS=252 ap=14 tcp=23 topuser=madalice 2026-08-30 12:21:25 L1=0.84 run=4 blk=0 avail=8271 (60.0%) swpO=0 conn=2 myRSS=2924 php=5 phpRSS=377 ap=14 tcp=24 topuser=madalice 2026-08-30 12:21:34 L1=1.59 run=28 blk=0 avail=7848 (57.0%) swpO=0 conn=6 myRSS=2924 php=26 phpRSS=1091 ap=47 tcp=46 topuser=infinium