INCIDENT 2026-08-30 16:37:48 trigger: php_rss=1567MB ================================================================== load: 5.73 2.58 1.58 13/666 998566 ncpu:10 mem_avail: 7072MB/13777MB (51.3%) swap_used:1770MB swapout:2/s blocked(D):0 running:17 iowait:0.0% steal:0.0% php: 18 procs / 1567MB heaviest user: infinium (13 procs, 1063MB) apache: 36 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3043 infinium 12 984 root 245 965 nobody 35 629 madalice 3 468 netdata 7 200 mailman 20 120 cpanellogin 1 118 mailnull 3 62 dovenull 6 47 wp-toolkit 3 30 evolution 5 22 zabbix 1 21 vinesit 1 21 dovecot 3 19 aaa 1 15 alison 1 14 named 1 13 kurri 1 12 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB infinium 10 928 madalice 3 468 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5995 MB Active(file): 4747 MB Inactive(file): 1692 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 596 MB CommitLimit: 10984 MB Committed_AS: 8219 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-14:19:09 7780 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3116332 7.0 Ssl 2-14:18:38 /usr/sbin/mariadbd 889551 2277352 root 191368 0.1 S 32:06 spamd child 508924 1 netdata 180660 1.9 Ssl 2-14:18:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175548 0.0 Ss 14:14:44 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 998070 510022 madalice 163044 33.4 S 00:25 php-fpm: pool madalice_com_au 998314 510022 madalice 158748 19.1 S 00:12 php-fpm: pool madalice_com_au 998266 510022 madalice 157544 37.8 S 00:15 php-fpm: pool madalice_com_au 2328311 2277352 root 156764 0.0 S 13:59:38 spamd child 998524 997569 infinium 127924 53.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 998529 998210 infinium 127396 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 4027958 1353308 cpanellogin 121528 0.0 S 05:39:35 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 998527 997674 infinium 103032 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 998531 997657 infinium 102372 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 998533 981816 infinium 96244 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 998532 998209 infinium 88208 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 998534 998508 infinium 86576 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 998541 997655 infinium 83528 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 998473 1353308 infinium 55336 4.3 S 00:03 webmaild - serving 1.41.252.211 509236 509098 root 53628 0.0 Sl 2-14:18:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 51256 0.0 Sl 2-14:18:02 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42576 0.1 Ss 39-13:56:30 cpsrvd (SSL) - waiting for connections 2275833 1 root 35608 0.0 Ss 14:15:34 lfd - sleeping 998602 980841 infinium 34896 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 892109 938407 infinium 29220 0.0 S 28:28 php-fpm: pool user_infinium 508720 1 mailnull 25284 0.0 Ss 2-14:18:11 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24048 0.1 Ss 62-06:27:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23336 0.0 Ss 2-14:18:00 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 980841 506832 nobody 22788 0.0 S 04:11 /usr/sbin/httpd -k start 963232 506832 nobody 22632 0.0 S 08:08 /usr/sbin/httpd -k start 483898 1 zabbix 22460 0.2 Ssl 2-14:19:21 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 981814 506832 nobody 22368 0.1 S 02:47 /usr/sbin/httpd -k start 891213 508511 vinesit 22164 0.0 S 29:58 dovecot/imap 1463 1 root 21888 0.0 Ss 62-06:27:59 tailwatchd 981539 506832 nobody 21244 0.0 S 03:14 /usr/sbin/httpd -k start 963231 506832 nobody 21228 0.1 S 08:08 /usr/sbin/httpd -k start 997671 506832 nobody 20848 0.1 S 00:46 /usr/sbin/httpd -k start 980866 506832 nobody 20816 0.0 S 04:10 /usr/sbin/httpd -k start 998323 508720 mailnull 20816 0.0 S 00:11 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 981816 506832 nobody 20812 0.1 S 02:47 /usr/sbin/httpd -k start 963205 506832 nobody 20604 0.2 S 08:08 /usr/sbin/httpd -k start 997618 506832 nobody 20252 0.1 S 00:48 /usr/sbin/httpd -k start 981818 506832 nobody 20152 0.1 S 02:47 /usr/sbin/httpd -k start 997674 506832 nobody 20136 0.1 S 00:46 /usr/sbin/httpd -k start 997655 506832 nobody 19696 0.1 S 00:47 /usr/sbin/httpd -k start 963108 506832 nobody 19452 0.2 S 08:13 /usr/sbin/httpd -k start 997617 506832 nobody 19124 0.1 S 00:48 /usr/sbin/httpd -k start 997609 506832 nobody 19104 0.1 S 00:49 /usr/sbin/httpd -k start 981804 506832 nobody 18876 0.0 S 02:48 /usr/sbin/httpd -k start 997673 506832 nobody 18836 0.1 S 00:46 /usr/sbin/httpd -k start 997680 506832 nobody 18448 0.1 S 00:46 /usr/sbin/httpd -k start 981813 506832 nobody 18292 0.0 S 02:47 /usr/sbin/httpd -k start 997608 506832 nobody 18232 0.2 S 00:49 /usr/sbin/httpd -k start 997669 506832 nobody 18200 0.2 S 00:46 /usr/sbin/httpd -k start 997569 506832 nobody 18128 0.2 S 00:50 /usr/sbin/httpd -k start 997657 506832 nobody 18036 0.1 S 00:47 /usr/sbin/httpd -k start 998209 506832 nobody 18024 0.2 S 00:18 /usr/sbin/httpd -k start 998189 506832 nobody 17988 0.1 S 00:19 /usr/sbin/httpd -k start 938582 1 wp-toolkit 17952 0.0 Ss 2-12:25:41 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 997654 506832 nobody 17948 0.1 S 00:47 /usr/sbin/httpd -k start 998150 506832 nobody 17816 0.2 S 00:20 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4592118 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min infinium/infinium.net.au-ssl_log 490 aaa/aaadownunder.com.au-ssl_log 209 bigdeals/bigdeals.com.au-ssl_log 184 candyfabcom/candyfab.com.au-ssl_log 90 vinesit/vinesit.com.au-ssl_log 81 otter2/otterfencing.net.au 45 kamcool/kamcool.com.au-ssl_log 38 evolution/portal.evolutionerp.com.au-ssl_log 28 madalice/madalice.com.au-ssl_log 26 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 488 93.123.109.228 234 20.48.179.39 184 20.48.251.3 90 20.104.49.130 65 52.139.37.240 45 20.220.10.235 28 203.54.180.238 25 4.205.62.107 7 146.70.36.140 6 1.43.109.231 6 118.127.40.55 3 2001:8004:14b3:854f:89bf:1540:714e:b0bd 2 51.68.111.209 2 114.119.138.179 2 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 63 GET /autodiscover/autodiscover.xml 28 GET /heartbeat.php 9 GET / 5 POST /wp-admin/admin-ajax.php 4 POST /wp-cron.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /log.php 4 GET /edit.php 4 GET /av.php 4 GET /admin.php 3 POST / 3 GET /xda.php 3 GET /wp-login.php 3 GET /wp-blog.php 3 GET /or.php 3 GET /new.php 3 GET /ms-edit.php 3 GET /dvve.php 3 GET /chosen.php --- busiest 3 vhosts: top paths + last 10 requests --- == infinium/infinium.net.au-ssl_log == -- top paths -- 4 GET / 2 POST /wp-cron.php 2 GET /login 1 GET /wp-login.php 1 GET /.wp-config.php.swp 1 GET /wp-config.php 1 GET /[workspace]/* 1 GET /.well-known/stripe.txt 1 GET /.well-known/stripe/ 1 GET /.well-known/acme-challenge/* 1 GET /.well-known/acme-challenge/ 1 GET /.well-known/* -- last 10 requests -- 93.123.109.228 - - [30/Aug/2026:16:37:46 +1000] "GET /var/task/nuxt.config.ts HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [30/Aug/2026:16:37:46 +1000] "GET /var/task/next.config.ts HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [30/Aug/2026:16:37:47 +1000] "GET /var/task/serverless.yml HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/1 93.123.109.228 - - [30/Aug/2026:16:37:47 +1000] "GET /web/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [30/Aug/2026:16:37:48 +1000] "GET /var/www/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [30/Aug/2026:16:37:48 +1000] "GET /var/www/html/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 93.123.109.228 - - [30/Aug/2026:16:37:47 +1000] "GET /var/task/serverless.yaml HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [30/Aug/2026:16:37:47 +1000] "GET /waku/* HTTP/1.1" 404 68225 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [30/Aug/2026:16:37:48 +1000] "GET /website/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [30/Aug/2026:16:37:48 +1000] "GET /wp-config.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 3 GET /av.php 3 GET /admin.php 2 POST /wp-cron.php 2 GET /wp-content/themes/index.php 2 GET /wp-blog.php 2 GET /wp-admin/maint/index.php 2 GET /wp-admin/css/colors/modern/ 2 GET /new.php 1 GET /zoom1.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xx.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:16:37:41 +1000] "GET /ca5.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:41 +1000] "GET /install.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:41 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 200 361 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:41 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:42 +1000] "GET /Ov-Simple1.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:42 +1000] "GET /ftde.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:42 +1000] "GET /hplfuns.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:42 +1000] "GET /log.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:42 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:16:37:43 +1000] "GET /wp-admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 2 GET /thui.php 2 GET /ms-edit.php 2 GET /koiy.php 2 GET /cloud.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xmy.php 1 GET /xin1.php -- last 10 requests -- 20.48.251.3 - - [30/Aug/2026:16:36:33 +1000] "GET /debuggen.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:34 +1000] "GET /pouhg.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:35 +1000] "GET /adminfus.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:35 +1000] "GET /avim.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:36 +1000] "GET /nw.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:36 +1000] "GET /product.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:36 +1000] "GET /fun.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:37 +1000] "GET /kedi.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:37 +1000] "GET /oc460l3x.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [30/Aug/2026:16:36:38 +1000] "GET /drykl.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 16:35:27 L1=2.39 run=3 blk=0 avail=8036 (58.3%) swpO=2 conn=2 myRSS=3043 php=5 phpRSS=395 ap=28 tcp=34 topuser=madalice 2026-08-30 16:35:28 L1=2.39 run=1 blk=0 avail=8048 (58.4%) swpO=2 conn=1 myRSS=3043 php=4 phpRSS=348 ap=28 tcp=32 topuser=madalice 2026-08-30 16:35:38 L1=2.33 run=1 blk=0 avail=7988 (58.0%) swpO=0 conn=2 myRSS=3043 php=4 phpRSS=442 ap=23 tcp=38 topuser=madalice 2026-08-30 16:35:38 L1=2.33 run=1 blk=0 avail=7983 (57.9%) swpO=0 conn=1 myRSS=3043 php=4 phpRSS=442 ap=23 tcp=36 topuser=madalice 2026-08-30 16:35:48 L1=2.12 run=6 blk=0 avail=8060 (58.5%) swpO=0 conn=2 myRSS=3043 php=5 phpRSS=407 ap=22 tcp=35 topuser=madalice 2026-08-30 16:35:48 L1=2.12 run=3 blk=0 avail=7842 (56.9%) swpO=0 conn=1 myRSS=3043 php=5 phpRSS=598 ap=22 tcp=33 topuser=madalice 2026-08-30 16:35:58 L1=2.50 run=1 blk=0 avail=8076 (58.6%) swpO=0 conn=1 myRSS=3043 php=4 phpRSS=353 ap=22 tcp=30 topuser=madalice 2026-08-30 16:35:58 L1=2.50 run=1 blk=0 avail=8080 (58.6%) swpO=0 conn=1 myRSS=3043 php=4 phpRSS=353 ap=22 tcp=31 topuser=madalice 2026-08-30 16:36:08 L1=2.43 run=4 blk=0 avail=8089 (58.7%) swpO=0 conn=1 myRSS=3043 php=5 phpRSS=385 ap=21 tcp=34 topuser=aaa 2026-08-30 16:36:08 L1=2.43 run=3 blk=0 avail=8197 (59.5%) swpO=0 conn=1 myRSS=3043 php=4 phpRSS=243 ap=21 tcp=32 topuser=madalice 2026-08-30 16:36:18 L1=2.13 run=1 blk=0 avail=8364 (60.7%) swpO=0 conn=1 myRSS=3043 php=2 phpRSS=35 ap=20 tcp=29 topuser=root 2026-08-30 16:36:18 L1=2.13 run=1 blk=0 avail=8360 (60.7%) swpO=0 conn=1 myRSS=3043 php=2 phpRSS=35 ap=20 tcp=29 topuser=root 2026-08-30 16:36:28 L1=1.80 run=1 blk=0 avail=8219 (59.7%) swpO=2 conn=1 myRSS=3043 php=3 phpRSS=207 ap=20 tcp=31 topuser=madalice 2026-08-30 16:36:28 L1=1.80 run=1 blk=0 avail=8219 (59.7%) swpO=2 conn=1 myRSS=3043 php=3 phpRSS=207 ap=20 tcp=31 topuser=madalice 2026-08-30 16:36:38 L1=1.60 run=1 blk=0 avail=7876 (57.2%) swpO=2 conn=1 myRSS=3043 php=5 phpRSS=595 ap=21 tcp=29 topuser=madalice 2026-08-30 16:36:39 L1=1.60 run=1 blk=0 avail=7874 (57.2%) swpO=1 conn=1 myRSS=3043 php=5 phpRSS=595 ap=21 tcp=27 topuser=madalice 2026-08-30 16:36:48 L1=1.44 run=1 blk=0 avail=8120 (58.9%) swpO=0 conn=1 myRSS=3043 php=4 phpRSS=329 ap=19 tcp=27 topuser=madalice 2026-08-30 16:36:49 L1=1.44 run=1 blk=0 avail=8127 (59.0%) swpO=0 conn=1 myRSS=3043 php=4 phpRSS=329 ap=19 tcp=27 topuser=madalice 2026-08-30 16:36:58 L1=1.29 run=1 blk=0 avail=8077 (58.6%) swpO=0 conn=1 myRSS=3043 php=4 phpRSS=360 ap=20 tcp=25 topuser=madalice 2026-08-30 16:36:59 L1=1.29 run=8 blk=0 avail=7924 (57.5%) swpO=0 conn=1 myRSS=3043 php=11 phpRSS=717 ap=21 tcp=45 topuser=infinium 2026-08-30 16:37:08 L1=2.52 run=3 blk=0 avail=7621 (55.3%) swpO=0 conn=1 myRSS=3043 php=6 phpRSS=691 ap=48 tcp=35 topuser=madalice 2026-08-30 16:37:09 L1=2.52 run=6 blk=0 avail=7682 (55.8%) swpO=0 conn=1 myRSS=3043 php=8 phpRSS=638 ap=47 tcp=36 topuser=madalice 2026-08-30 16:37:18 L1=3.58 run=18 blk=0 avail=7844 (56.9%) swpO=0 conn=1 myRSS=3043 php=11 phpRSS=613 ap=40 tcp=39 topuser=infinium 2026-08-30 16:37:19 L1=3.58 run=10 blk=0 avail=8023 (58.2%) swpO=0 conn=7 myRSS=3043 php=8 phpRSS=433 ap=39 tcp=37 topuser=infinium 2026-08-30 16:37:28 L1=3.49 run=8 blk=0 avail=7703 (55.9%) swpO=0 conn=1 myRSS=3043 php=11 phpRSS=780 ap=33 tcp=38 topuser=infinium 2026-08-30 16:37:29 L1=3.49 run=12 blk=0 avail=7929 (57.6%) swpO=0 conn=7 myRSS=3043 php=10 phpRSS=618 ap=33 tcp=42 topuser=infinium 2026-08-30 16:37:38 L1=5.42 run=14 blk=0 avail=7546 (54.8%) swpO=0 conn=1 myRSS=3043 php=11 phpRSS=963 ap=38 tcp=48 topuser=madalice 2026-08-30 16:37:39 L1=5.42 run=8 blk=0 avail=7414 (53.8%) swpO=0 conn=7 myRSS=3043 php=8 phpRSS=915 ap=37 tcp=49 topuser=madalice 2026-08-30 16:37:48 L1=5.73 run=17 blk=0 avail=7072 (51.3%) swpO=2 conn=11 myRSS=3043 php=18 phpRSS=1567 ap=36 tcp=50 topuser=infinium 2026-08-30 16:37:49 L1=5.73 run=12 blk=0 avail=7351 (53.4%) swpO=2 conn=7 myRSS=3043 php=14 phpRSS=1260 ap=37 tcp=49 topuser=infinium