INCIDENT 2026-08-31 20:09:16 trigger: php_rss=1662MB ================================================================== load: 2.78 2.47 1.75 6/682 2655083 ncpu:10 mem_avail: 6430MB/13777MB (46.7%) swap_used:2280MB swapout:0/s blocked(D):0 running:6 iowait:0.0% steal:0.0% php: 15 procs / 1662MB heaviest user: madalice (7 procs, 1002MB) apache: 44 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3409 root 252 1087 madalice 7 1002 nobody 43 727 evolution 11 356 netdata 7 208 speedlin 1 158 customc 1 125 cpanellogin 1 78 infinium 2 75 mailman 20 72 dovenull 6 46 zabbix 1 19 wp-toolkit 3 19 dovecot 3 18 mailnull 1 15 candyfabcom 1 14 aaa 1 14 kurri 1 12 named 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 7 1002 evolution 5 357 customc 1 127 speedlin 1 24 root 1 21 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5446 MB Active(file): 4822 MB Inactive(file): 941 MB Dirty: 5 MB Writeback: 0 MB SReclaimable: 602 MB CommitLimit: 10984 MB Committed_AS: 8915 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-17:50:37 4196 /usr/bin/imunify-agent-proxy 2618962 root 09:15 1260 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 2636997 root 04:30 60828 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3491540 9.4 Ssl 3-17:50:06 /usr/sbin/mariadbd 1247229 3002570 root 194544 0.1 S 06:39:07 spamd child 508924 1 netdata 188816 1.9 Ssl 3-17:49:35 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2654200 510022 madalice 162964 8.4 S 00:56 php-fpm: pool madalice_com_au 3036528 3002570 root 161088 0.0 S 17:37:34 spamd child 2654729 510022 madalice 159712 12.3 S 00:21 php-fpm: pool madalice_com_au 2654727 510022 madalice 159032 12.0 S 00:21 php-fpm: pool madalice_com_au 2655049 2653854 customc 138888 52.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2654734 510022 madalice 136376 6.3 S 00:21 php-fpm: pool madalice_com_au 2654732 510022 madalice 136328 6.4 S 00:21 php-fpm: pool madalice_com_au 2654728 510022 madalice 136324 6.3 S 00:21 php-fpm: pool madalice_com_au 2654733 510022 madalice 136308 6.2 S 00:21 php-fpm: pool madalice_com_au 2655048 2654341 evolution 99784 31.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3002570 1 root 99184 0.0 Ss 17:46:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2197517 1353308 cpanellogin 80128 0.0 S 02:16:26 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509266 1 root 79104 0.0 Ss 3-17:49:32 /usr/lib/systemd/systemd-journald 509640 508992 root 70812 0.0 Sl 3-17:49:30 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 69752 0.0 Sl 3-17:49:32 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2636997 1 root 60828 0.8 Ssl 04:30 /opt/imunify360/venv/bin/python3 -m imav.run 2655088 2651721 evolution 60180 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2654639 1353308 infinium 55796 0.4 S 00:29 webmaild - serving 1.41.252.211 1353308 1 root 42608 0.1 Ss 40-17:27:58 cpsrvd (SSL) - waiting for connections 2655052 2651628 evolution 40664 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 33956 0.0 Ss 17:47:02 lfd - sleeping 2655050 1469 root 28840 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2655067 1469 root 28840 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2635407 506832 nobody 23984 0.0 S 06:22 /usr/sbin/httpd -k start 2651721 506832 nobody 22808 0.0 S 03:38 /usr/sbin/httpd -k start 510022 1 root 22376 0.0 Ss 3-17:49:28 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2651647 506832 nobody 22368 0.1 S 03:40 /usr/sbin/httpd -k start 1463 1 root 22168 0.0 Ss 63-09:59:27 tailwatchd 2653393 506832 nobody 21580 0.0 S 01:50 /usr/sbin/httpd -k start 2654641 938407 infinium 21536 0.1 S 00:29 php-fpm: pool user_infinium 1469 1 root 21376 0.1 Ss 63-09:59:27 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2651702 506832 nobody 20888 0.0 S 03:38 /usr/sbin/httpd -k start 2651701 506832 nobody 20884 0.0 S 03:38 /usr/sbin/httpd -k start 2634626 506832 nobody 20648 0.0 S 07:20 /usr/sbin/httpd -k start 483898 1 zabbix 20072 0.2 Ssl 3-17:50:49 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2651698 506832 nobody 20012 0.1 S 03:38 /usr/sbin/httpd -k start 2651708 506832 nobody 19984 0.0 S 03:38 /usr/sbin/httpd -k start 2654329 506832 nobody 19872 0.0 S 00:48 /usr/sbin/httpd -k start 2651543 506832 nobody 19332 0.0 S 03:44 /usr/sbin/httpd -k start 2651676 506832 nobody 19140 0.0 S 03:39 /usr/sbin/httpd -k start 2651686 506832 nobody 19040 0.0 S 03:39 /usr/sbin/httpd -k start 2654341 506832 nobody 19040 0.2 S 00:47 /usr/sbin/httpd -k start 2651670 506832 nobody 18992 0.0 S 03:39 /usr/sbin/httpd -k start 2654777 506832 nobody 18980 0.0 S 00:18 /usr/sbin/httpd -k start 2654342 506832 nobody 18632 0.0 S 00:47 /usr/sbin/httpd -k start 2654793 506832 nobody 18580 0.0 S 00:17 /usr/sbin/httpd -k start 2654767 506832 nobody 18476 0.0 S 00:19 /usr/sbin/httpd -k start 2654883 506832 nobody 18472 0.0 S 00:12 /usr/sbin/httpd -k start 2654496 506832 nobody 18120 0.0 S 00:39 /usr/sbin/httpd -k start 2653920 506832 nobody 17904 0.1 S 01:10 /usr/sbin/httpd -k start 2651628 506832 nobody 17688 0.0 S 03:41 /usr/sbin/httpd -k start 2653854 506832 nobody 17344 0.0 S 01:11 /usr/sbin/httpd -k start 2654768 506832 nobody 17224 0.0 S 00:19 /usr/sbin/httpd -k start 2653538 506832 nobody 17200 0.1 S 01:36 /usr/sbin/httpd -k start 2654885 506832 nobody 17156 0.0 S 00:12 /usr/sbin/httpd -k start 2654882 506832 nobody 17144 0.0 S 00:12 /usr/sbin/httpd -k start 2654884 506832 nobody 17144 0.0 S 00:12 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9839823 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 261 whiz/whizengineering.com.au-ssl_log 179 customc/customcentral.com.au-ssl_log 175 evolution/evolutionerp.com.au-ssl_log 147 customc/customcentral.com.au 65 speedlin/speedlinefencing.com.au-ssl_log 58 infinium/infinium.net.au-ssl_log 54 alison/alisonarts.com.au-ssl_log 44 evolution/evolutionerp.com.au 40 evolution/my.evolutionerp.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 21 speedlin/speedlinefencing.com.au 18 alison/alisonarts.com.au 10 madalice/madalice.com.au-ssl_log 8 corpkicks/corporatekicks.com.au-ssl_log 4 (total vhosts taking traffic: 15) --- top client IPs across all vhosts (last 3 min) --- 261 34.17.131.38 226 158.23.147.79 179 52.139.37.240 84 20.104.18.15 79 20.151.10.161 51 20.220.211.172 49 52.139.44.162 26 85.203.23.204 25 85.203.23.209 24 85.203.23.177 23 175.36.227.212 19 203.54.180.238 12 85.203.23.212 12 147.161.213.78 10 85.203.23.206 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 12 POST /itemModify.php 9 GET / 8 POST /testTagSave.php 8 POST /functions.php 8 POST / 7 POST /wp-cron.php 7 POST /app/ajax/selectFilter.php 7 GET /wp-login.php 6 GET /wp-admin/css/ 6 GET /new.php 6 GET /av.php 5 GET /wp-includes/ 5 GET /tinyfilemanager.php 5 GET /simple.php 5 GET /run.php 5 GET /403.php 4 GET /ws.php 4 GET /wp-trackback.php 4 GET /wp-includes/bk/ --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.17.131.38 - - [31/Aug/2026:20:09:05 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:05 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:06 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:06 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:06 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:07 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:07 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:07 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:07 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.131.38 - - [31/Aug/2026:20:09:08 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 2 GET /mar.php 2 GET /function.php 1 GET /zwso.php 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp-mail.php 1 GET /wp-load.php -- last 10 requests -- 52.139.37.240 - - [31/Aug/2026:20:09:12 +1000] "GET /admin/function.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:13 +1000] "GET /wp-includes/pomo/about.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:13 +1000] "GET /wp-content/uploads/2024/index.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [31/Aug/2026:20:09:13 +1000] "GET /.well-known/cong.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:13 +1000] "GET /wp-content/languages/about.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:14 +1000] "GET /edit.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:14 +1000] "GET /wp-admin/network/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:14 +1000] "GET /about/function.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:14 +1000] "GET /simple/function.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:20:09:15 +1000] "GET /mah/function.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 4 POST /wp-cron.php 3 GET /wp-admin/css/colors/blue/ 3 GET /wp-admin/css/ 2 GET /wp-includes/ID3/ 2 GET /wp-includes/block-bindings/ 2 GET /wp-includes/assets/ 2 GET /wp-content/themes/index.php 2 GET /wp-blog.php 2 GET /new.php 2 GET /av.php 1 GET /zoo1.php 1 GET /xx.php -- last 10 requests -- 158.23.147.79 - - [31/Aug/2026:20:08:55 +1000] "GET /wp-includes/assets/index.php HTTP/1.1" 301 - "-" "-" 158.23.147.79 - - [31/Aug/2026:20:08:55 +1000] "GET /wp-includes/assets/ HTTP/1.1" 404 73289 "-" "-" 158.23.147.79 - - [31/Aug/2026:20:08:57 +1000] "GET /wp-the.php HTTP/1.1" 404 73280 "-" "-" 158.23.147.79 - - [31/Aug/2026:20:08:59 +1000] "GET /ws81.php HTTP/1.1" 404 73278 "-" "-" 158.23.147.79 - - [31/Aug/2026:20:09:00 +1000] "GET /3.php HTTP/1.1" 404 73275 "-" "-" 158.23.147.79 - - [31/Aug/2026:20:09:02 +1000] "GET /a1.php HTTP/1.1" 404 73276 "-" "-" 158.23.147.79 - - [31/Aug/2026:20:09:03 +1000] "GET /ca5.php HTTP/1.1" 404 73277 "-" "-" 118.127.40.55 - - [31/Aug/2026:20:09:06 +1000] "POST /wp-cron.php?doing_wp_cron=1788170946.2357499599456787109375 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://customcentral.com.au" 158.23.147.79 - - [31/Aug/2026:20:09:05 +1000] "GET /install.php HTTP/1.1" 404 73281 "-" "-" 158.23.147.79 - - [31/Aug/2026:20:09:07 +1000] "GET /radio.php HTTP/1.1" 403 13 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 20:06:53 L1=2.61 run=6 blk=0 avail=7250 (52.6%) swpO=0 conn=1 myRSS=3409 php=7 phpRSS=521 ap=47 tcp=38 topuser=madalice 2026-08-31 20:06:55 L1=2.61 run=2 blk=0 avail=7562 (54.9%) swpO=0 conn=3 myRSS=3409 php=4 phpRSS=229 ap=45 tcp=39 topuser=madalice 2026-08-31 20:07:03 L1=2.74 run=2 blk=0 avail=7533 (54.7%) swpO=0 conn=1 myRSS=3409 php=4 phpRSS=323 ap=37 tcp=33 topuser=madalice 2026-08-31 20:07:05 L1=2.74 run=5 blk=0 avail=7236 (52.5%) swpO=0 conn=3 myRSS=3409 php=9 phpRSS=789 ap=35 tcp=38 topuser=customc 2026-08-31 20:07:14 L1=3.02 run=3 blk=0 avail=7527 (54.6%) swpO=0 conn=1 myRSS=3409 php=5 phpRSS=392 ap=31 tcp=34 topuser=madalice 2026-08-31 20:07:15 L1=3.02 run=3 blk=0 avail=7652 (55.5%) swpO=0 conn=3 myRSS=3409 php=5 phpRSS=281 ap=30 tcp=33 topuser=madalice 2026-08-31 20:07:24 L1=2.87 run=6 blk=0 avail=7490 (54.4%) swpO=0 conn=1 myRSS=3409 php=7 phpRSS=530 ap=27 tcp=39 topuser=madalice 2026-08-31 20:07:25 L1=2.87 run=3 blk=0 avail=7648 (55.5%) swpO=0 conn=3 myRSS=3409 php=6 phpRSS=324 ap=27 tcp=42 topuser=madalice 2026-08-31 20:07:34 L1=2.97 run=4 blk=0 avail=7606 (55.2%) swpO=0 conn=3 myRSS=3409 php=6 phpRSS=371 ap=28 tcp=34 topuser=madalice 2026-08-31 20:07:35 L1=2.97 run=3 blk=0 avail=7578 (55.0%) swpO=0 conn=3 myRSS=3409 php=5 phpRSS=368 ap=27 tcp=36 topuser=corpkicks 2026-08-31 20:07:44 L1=3.06 run=5 blk=0 avail=7552 (54.8%) swpO=0 conn=3 myRSS=3409 php=7 phpRSS=434 ap=28 tcp=35 topuser=speedlin 2026-08-31 20:07:45 L1=3.06 run=3 blk=0 avail=7770 (56.4%) swpO=0 conn=3 myRSS=3409 php=3 phpRSS=113 ap=28 tcp=36 topuser=speedlin 2026-08-31 20:07:54 L1=2.98 run=4 blk=0 avail=7497 (54.4%) swpO=0 conn=3 myRSS=3409 php=6 phpRSS=488 ap=28 tcp=33 topuser=madalice 2026-08-31 20:07:55 L1=3.06 run=5 blk=0 avail=7499 (54.4%) swpO=0 conn=3 myRSS=3409 php=7 phpRSS=512 ap=28 tcp=35 topuser=madalice 2026-08-31 20:08:04 L1=3.14 run=4 blk=0 avail=7481 (54.3%) swpO=0 conn=3 myRSS=3409 php=6 phpRSS=477 ap=28 tcp=42 topuser=madalice 2026-08-31 20:08:05 L1=3.13 run=6 blk=0 avail=7482 (54.3%) swpO=0 conn=3 myRSS=3409 php=6 phpRSS=493 ap=29 tcp=44 topuser=customc 2026-08-31 20:08:14 L1=3.20 run=5 blk=0 avail=7653 (55.6%) swpO=0 conn=3 myRSS=3409 php=5 phpRSS=290 ap=31 tcp=37 topuser=speedlin 2026-08-31 20:08:15 L1=3.18 run=7 blk=0 avail=7686 (55.8%) swpO=0 conn=3 myRSS=3409 php=5 phpRSS=270 ap=31 tcp=41 topuser=alison 2026-08-31 20:08:24 L1=3.41 run=4 blk=0 avail=7421 (53.9%) swpO=0 conn=3 myRSS=3409 php=6 phpRSS=538 ap=32 tcp=38 topuser=madalice 2026-08-31 20:08:25 L1=3.29 run=3 blk=0 avail=7369 (53.5%) swpO=0 conn=3 myRSS=3409 php=7 phpRSS=624 ap=32 tcp=42 topuser=madalice 2026-08-31 20:08:34 L1=3.35 run=7 blk=0 avail=7388 (53.6%) swpO=0 conn=3 myRSS=3409 php=6 phpRSS=542 ap=35 tcp=43 topuser=madalice 2026-08-31 20:08:36 L1=3.24 run=10 blk=0 avail=7204 (52.3%) swpO=0 conn=3 myRSS=3409 php=8 phpRSS=793 ap=34 tcp=51 topuser=madalice 2026-08-31 20:08:44 L1=3.14 run=2 blk=0 avail=7635 (55.4%) swpO=0 conn=3 myRSS=3409 php=4 phpRSS=255 ap=35 tcp=37 topuser=madalice 2026-08-31 20:08:46 L1=3.05 run=2 blk=0 avail=7525 (54.6%) swpO=0 conn=3 myRSS=3409 php=4 phpRSS=312 ap=34 tcp=38 topuser=madalice 2026-08-31 20:08:54 L1=2.89 run=3 blk=0 avail=7686 (55.8%) swpO=0 conn=3 myRSS=3409 php=3 phpRSS=192 ap=25 tcp=32 topuser=madalice 2026-08-31 20:08:56 L1=2.82 run=12 blk=0 avail=7396 (53.7%) swpO=0 conn=3 myRSS=3409 php=11 phpRSS=679 ap=24 tcp=42 topuser=madalice 2026-08-31 20:09:04 L1=2.99 run=4 blk=0 avail=6462 (46.9%) swpO=0 conn=3 myRSS=3409 php=12 phpRSS=1482 ap=53 tcp=68 topuser=madalice 2026-08-31 20:09:06 L1=2.91 run=2 blk=0 avail=6668 (48.4%) swpO=0 conn=3 myRSS=3409 php=11 phpRSS=1239 ap=53 tcp=55 topuser=madalice 2026-08-31 20:09:14 L1=2.76 run=5 blk=0 avail=6720 (48.8%) swpO=0 conn=3 myRSS=3409 php=12 phpRSS=1269 ap=45 tcp=31 topuser=madalice 2026-08-31 20:09:16 L1=2.78 run=6 blk=0 avail=6430 (46.7%) swpO=0 conn=6 myRSS=3409 php=15 phpRSS=1662 ap=44 tcp=35 topuser=madalice