INCIDENT 2026-08-31 22:35:09 trigger: php_rss=1680MB ================================================================== load: 2.17 1.23 1.20 13/663 3160458 ncpu:10 mem_avail: 6511MB/13777MB (47.3%) swap_used:2302MB swapout:64/s blocked(D):0 running:14 iowait:0.6% steal:0.0% php: 12 procs / 1680MB heaviest user: madalice (8 procs, 1391MB) apache: 26 procs tcp_estab: 45 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3353 madalice 8 1425 root 248 962 nobody 25 436 corpkicks 2 232 netdata 7 208 infinium 3 137 cpanellogin 1 78 mailman 20 66 cpanelphpmyadmin 2 60 dovenull 6 46 evolution 10 35 lowrange 2 29 mailnull 2 28 zabbix 1 19 wp-toolkit 3 18 dovecot 3 18 aaa 1 15 vinesit 1 14 alison 1 14 --- php workers by user --- USER PROCS RSS_MB madalice 8 1322 corpkicks 1 223 infinium 1 61 root 1 21 evolution 1 10 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5721 MB Active(file): 3713 MB Inactive(file): 2258 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 509 MB CommitLimit: 10984 MB Committed_AS: 8441 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-20:16:30 3684 /usr/bin/imunify-agent-proxy 3150724 root 00:08 1324 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3433764 9.3 Ssl 3-20:15:59 /usr/sbin/mariadbd 3158990 3150257 corpkicks 234116 119 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3159175 510022 madalice 218032 113 R 00:01 php-fpm: pool madalice_com_au 3159176 510022 madalice 212224 107 R 00:01 php-fpm: pool madalice_com_au 3158139 510022 madalice 202704 49.0 S 00:02 php-fpm: pool madalice_com_au 1247229 3002570 root 190268 0.1 S 09:05:00 spamd child 508924 1 netdata 188888 1.9 Ssl 3-20:15:28 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3150266 510022 madalice 168816 18.2 R 00:36 php-fpm: pool madalice_com_au 3036528 3002570 root 160584 0.0 S 20:03:27 spamd child 3156497 510022 madalice 148528 61.3 R 00:03 php-fpm: pool madalice_com_au 3156483 510022 madalice 143932 64.0 R 00:03 php-fpm: pool madalice_com_au 3156971 510022 madalice 139476 45.0 S 00:03 php-fpm: pool madalice_com_au 3156972 510022 madalice 139268 47.3 S 00:03 php-fpm: pool madalice_com_au 3002570 1 root 87652 0.0 Ss 20:12:23 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 84264 0.0 Ss 3-20:15:25 /usr/lib/systemd/systemd-journald 2197517 1353308 cpanellogin 80148 0.0 S 04:42:19 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3160344 3159758 infinium 74572 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509640 508992 root 72652 0.0 Sl 3-20:15:23 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 67904 0.0 Sl 3-20:15:25 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3150591 1353308 infinium 54592 0.6 S 00:20 webmaild - serving 1.41.252.211 1353308 1 root 41196 0.1 Ss 40-19:53:51 cpsrvd (SSL) - waiting for connections 3150149 1353308 cpanelphpmyadmin 38600 0.0 S 00:43 whostmgrd - serving 202.153.211.134 3001917 1 root 33772 0.0 Ss 20:12:55 lfd - sleeping 3030978 938407 infinium 28824 0.0 S 35:55 php-fpm: pool user_infinium 3150232 938407 cpanelphpmyadmin 22928 0.1 S 00:38 php-fpm: pool cpanelphpmyadmin 510022 1 root 22080 0.0 Ss 3-20:15:21 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3133336 506832 nobody 21984 0.2 S 06:34 /usr/sbin/httpd -k start 3150282 506832 nobody 21556 0.1 S 00:35 /usr/sbin/httpd -k start 3149718 506832 nobody 21236 0.0 S 01:33 /usr/sbin/httpd -k start 1469 1 root 21072 0.1 Ss 63-12:25:20 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 21044 0.0 Ss 63-12:25:20 tailwatchd 3148138 506832 nobody 20992 0.2 S 04:46 /usr/sbin/httpd -k start 3149218 506832 nobody 20952 0.0 S 02:35 /usr/sbin/httpd -k start 3150253 506832 nobody 20336 0.1 S 00:36 /usr/sbin/httpd -k start 3150281 506832 nobody 20308 0.1 S 00:35 /usr/sbin/httpd -k start 3150289 506832 nobody 20016 0.1 S 00:35 /usr/sbin/httpd -k start 3148842 506832 nobody 20000 0.1 S 03:14 /usr/sbin/httpd -k start 3150294 506832 nobody 19944 0.1 S 00:35 /usr/sbin/httpd -k start 483898 1 zabbix 19816 0.2 Ssl 3-20:16:42 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3149747 506832 nobody 19692 0.0 S 01:32 /usr/sbin/httpd -k start 3150224 506832 nobody 19316 0.1 S 00:39 /usr/sbin/httpd -k start 3150292 506832 nobody 19240 0.1 S 00:35 /usr/sbin/httpd -k start 3150257 506832 nobody 19236 0.1 S 00:36 /usr/sbin/httpd -k start 3150296 506832 nobody 19156 0.0 S 00:35 /usr/sbin/httpd -k start 3149778 506832 nobody 18844 0.0 S 01:30 /usr/sbin/httpd -k start 3149228 506832 nobody 18032 0.0 S 02:34 /usr/sbin/httpd -k start 3134032 506832 nobody 17864 0.0 S 05:30 /usr/sbin/httpd -k start 3150235 506832 nobody 17584 0.0 S 00:38 /usr/sbin/httpd -k start 3150290 506832 nobody 17256 0.0 S 00:35 /usr/sbin/httpd -k start 509671 508992 netdata 16680 2.1 Sl 3-20:15:23 /usr/libexec/netdata/plugins.d/apps.plugin 1 3159758 506832 nobody 16472 0.0 S 00:01 /usr/sbin/httpd -k start 3159757 506832 nobody 16052 0.0 S 00:01 /usr/sbin/httpd -k start 3158322 506832 nobody 15940 0.0 S 00:02 /usr/sbin/httpd -k start 2856707 508511 aaa 15936 0.0 S 01:28:40 dovecot/imap 508720 1 mailnull 15816 0.0 Ss 3-20:15:32 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3150608 1471 root 15588 0.0 S 00:20 cPhulkd - processor - http socket 3098283 508511 lowrange 15360 0.0 S 18:11 dovecot/imap 2977131 508511 lowrange 15256 0.0 S 53:58 dovecot/imap 1471 1 root 15064 0.0 Ss 63-12:25:20 cPhulkd - processor 32289 1471 root 15012 0.0 S 14:21:24 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9968112 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min infinium/infinium.net.au-ssl_log 195 tubesupplies/tubesupplies.com.au-ssl_log 188 customc/customcentral.com.au-ssl_log 78 infinium/infinium.net.au 34 evolution/portal.evolutionerp.com.au-ssl_log 22 madalice/madalice.com.au-ssl_log 22 evolution/my.evolutionerp.com.au-ssl_log 21 evolution/app.evolutionerp.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 2 nrg/nrgservices.net.au-ssl_log 1 otterfencing/otterfencing.com.au-ssl_log 1 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 185 52.139.37.240 108 74.248.24.12 100 68.155.159.216 65 52.139.44.162 26 13.213.5.99 22 203.54.180.238 15 101.119.138.142 9 118.127.40.55 7 62.60.130.247 5 40.115.94.245 4 56.10.80.37 3 147.161.213.78 2 69.6.213.81 2 57.131.41.149 2 52.167.144.187 --- top request paths across all vhosts (last 3 min) --- 65 GET /autodiscover/autodiscover.xml 22 GET /heartbeat.php 19 POST /functions.php 14 GET /wp-login.php 9 POST /wp-login.php 8 POST / 7 POST /wp-cron.php 5 GET / 3 GET /wp-includes/fonts/ 3 GET /wp-content/uploads/index.php 3 GET /wp-content/uploads/ 3 GET /wp-admin/js/ 3 GET /ms-edit.php 3 GET /manager.php 2 GET /zwso.php 2 GET /zup.php73 2 GET /ww5.php 2 GET /ws83.php 2 GET /wp-includes/Requests/library/index.php 2 GET /wp-includes/fonts/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == infinium/infinium.net.au-ssl_log == -- top paths -- 9 GET /wp-login.php 6 POST /wp-login.php 5 POST /wp-cron.php 2 GET /zup.php73 2 GET /ww5.php 2 GET /wp-includes/fonts/ 2 GET /wp-admin/js/ 2 GET /rip.php 1 POST / 1 GET /zwso.php 1 GET /yindu.php 1 GET /xmrlpc.php -- last 10 requests -- 68.155.159.216 - - [31/Aug/2026:22:35:00 +1000] "GET /item.php HTTP/1.1" 404 68225 "-" "-" 74.248.24.12 - - [31/Aug/2026:22:35:00 +1000] "GET /hello.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 69.6.213.81 - - [31/Aug/2026:22:35:00 +1000] "POST /wp-login.php HTTP/1.1" 503 6744 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0. 50.6.109.131 - - [31/Aug/2026:22:35:01 +1000] "GET /wp-login.php HTTP/1.1" 200 1975 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 68.155.159.216 - - [31/Aug/2026:22:35:01 +1000] "GET /jga.php HTTP/1.1" 404 68225 "-" "-" 74.248.24.12 - - [31/Aug/2026:22:35:01 +1000] "GET /IDhrIlrLb.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 50.6.109.131 - - [31/Aug/2026:22:35:02 +1000] "POST /wp-login.php HTTP/1.1" 503 6744 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0 74.248.24.12 - - [31/Aug/2026:22:35:03 +1000] "GET /fi2.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.159.216 - - [31/Aug/2026:22:35:03 +1000] "GET /mac.php HTTP/1.1" 404 68225 "-" "-" 162.241.203.147 - - [31/Aug/2026:22:35:03 +1000] "GET /wp-login.php HTTP/1.1" 200 1975 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /wp-login.php 2 GET /mar.php 1 POST /wp-login.php 1 GET /zwso.php 1 GET /xl.php 1 GET /ws.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-load.php 1 GET /wp-links.php -- last 10 requests -- 52.139.37.240 - - [31/Aug/2026:22:34:56 +1000] "GET /wp-admin/images/cloud.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:34:56 +1000] "GET /wp-includes/images/smilies/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 52.139.37.240 - - [31/Aug/2026:22:34:57 +1000] "GET /files.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:34:58 +1000] "GET /wp-includes/Text/index.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:34:58 +1000] "GET /wp-content/upgrade-temp-backup/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safa 52.139.37.240 - - [31/Aug/2026:22:34:59 +1000] "GET /.well-known/pki-validation/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 52.139.37.240 - - [31/Aug/2026:22:35:00 +1000] "GET /wp-includes/block-patterns/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 52.139.37.240 - - [31/Aug/2026:22:35:00 +1000] "GET /wp-includes/js/tinymce/plugins/compat3x/css/index.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 52.139.37.240 - - [31/Aug/2026:22:35:01 +1000] "GET /wp-includes/rest-api/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:02 +1000] "GET /ws.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 65 GET /autodiscover/autodiscover.xml 7 POST / 2 POST /wp-login.php 2 GET /wp-login.php 1 POST /wp-json/batch/v1 1 POST /wp-cron.php -- last 10 requests -- 52.139.44.162 - - [31/Aug/2026:22:34:55 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:34:56 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:34:57 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:34:58 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:34:59 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:35:00 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:35:03 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:35:04 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:35:05 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 52.139.44.162 - - [31/Aug/2026:22:35:06 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 22:32:46 L1=0.92 run=2 blk=0 avail=7855 (57.0%) swpO=0 conn=2 myRSS=3354 php=5 phpRSS=291 ap=21 tcp=29 topuser=madalice 2026-08-31 22:32:48 L1=1.00 run=3 blk=0 avail=7688 (55.8%) swpO=0 conn=1 myRSS=3354 php=6 phpRSS=466 ap=21 tcp=35 topuser=infinium 2026-08-31 22:32:56 L1=1.00 run=5 blk=0 avail=7769 (56.4%) swpO=0 conn=2 myRSS=3354 php=7 phpRSS=413 ap=20 tcp=28 topuser=infinium 2026-08-31 22:32:58 L1=0.92 run=1 blk=0 avail=7802 (56.6%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=286 ap=20 tcp=30 topuser=madalice 2026-08-31 22:33:06 L1=0.85 run=1 blk=0 avail=7994 (58.0%) swpO=0 conn=2 myRSS=3354 php=3 phpRSS=72 ap=20 tcp=29 topuser=evolution 2026-08-31 22:33:08 L1=0.94 run=2 blk=0 avail=7882 (57.2%) swpO=0 conn=2 myRSS=3354 php=3 phpRSS=187 ap=20 tcp=29 topuser=corpkicks 2026-08-31 22:33:16 L1=0.94 run=1 blk=0 avail=7884 (57.2%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=204 ap=20 tcp=28 topuser=madalice 2026-08-31 22:33:18 L1=1.03 run=4 blk=0 avail=7787 (56.5%) swpO=0 conn=2 myRSS=3354 php=5 phpRSS=336 ap=19 tcp=27 topuser=infinium 2026-08-31 22:33:27 L1=1.11 run=3 blk=0 avail=7774 (56.4%) swpO=0 conn=2 myRSS=3354 php=6 phpRSS=382 ap=19 tcp=27 topuser=infinium 2026-08-31 22:33:28 L1=1.02 run=1 blk=0 avail=7907 (57.4%) swpO=0 conn=2 myRSS=3354 php=3 phpRSS=163 ap=19 tcp=26 topuser=madalice 2026-08-31 22:33:37 L1=1.02 run=2 blk=0 avail=7854 (57.0%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=234 ap=21 tcp=32 topuser=madalice 2026-08-31 22:33:38 L1=1.02 run=2 blk=0 avail=7833 (56.9%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=245 ap=23 tcp=33 topuser=madalice 2026-08-31 22:33:47 L1=1.01 run=4 blk=0 avail=7777 (56.4%) swpO=1 conn=2 myRSS=3354 php=6 phpRSS=358 ap=22 tcp=25 topuser=infinium 2026-08-31 22:33:48 L1=1.09 run=2 blk=0 avail=7860 (57.1%) swpO=1 conn=2 myRSS=3354 php=4 phpRSS=238 ap=21 tcp=29 topuser=madalice 2026-08-31 22:33:57 L1=1.09 run=7 blk=0 avail=7827 (56.8%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=276 ap=18 tcp=24 topuser=madalice 2026-08-31 22:33:59 L1=1.00 run=1 blk=0 avail=8033 (58.3%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=58 ap=18 tcp=24 topuser=infinium 2026-08-31 22:34:07 L1=1.00 run=3 blk=0 avail=7976 (57.9%) swpO=0 conn=2 myRSS=3354 php=3 phpRSS=121 ap=18 tcp=25 topuser=infinium 2026-08-31 22:34:09 L1=0.92 run=2 blk=0 avail=8032 (58.3%) swpO=0 conn=1 myRSS=3354 php=2 phpRSS=32 ap=18 tcp=25 topuser=root 2026-08-31 22:34:17 L1=0.93 run=2 blk=0 avail=7865 (57.1%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=251 ap=18 tcp=24 topuser=madalice 2026-08-31 22:34:19 L1=0.93 run=1 blk=0 avail=7924 (57.5%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=162 ap=18 tcp=23 topuser=madalice 2026-08-31 22:34:27 L1=0.86 run=2 blk=0 avail=7847 (57.0%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=259 ap=18 tcp=30 topuser=madalice 2026-08-31 22:34:29 L1=0.95 run=4 blk=0 avail=7900 (57.3%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=162 ap=19 tcp=32 topuser=madalice 2026-08-31 22:34:37 L1=1.03 run=4 blk=0 avail=7472 (54.2%) swpO=0 conn=2 myRSS=3354 php=7 phpRSS=478 ap=49 tcp=49 topuser=customc 2026-08-31 22:34:39 L1=1.27 run=2 blk=1 avail=7352 (53.4%) swpO=0 conn=1 myRSS=3354 php=6 phpRSS=577 ap=47 tcp=54 topuser=corpkicks 2026-08-31 22:34:47 L1=1.41 run=6 blk=0 avail=7495 (54.4%) swpO=0 conn=2 myRSS=3354 php=6 phpRSS=511 ap=39 tcp=36 topuser=madalice 2026-08-31 22:34:49 L1=1.54 run=1 blk=0 avail=7757 (56.3%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=186 ap=37 tcp=32 topuser=madalice 2026-08-31 22:34:57 L1=1.49 run=1 blk=0 avail=7794 (56.6%) swpO=0 conn=2 myRSS=3354 php=3 phpRSS=186 ap=29 tcp=35 topuser=madalice 2026-08-31 22:34:59 L1=1.45 run=5 blk=0 avail=7629 (55.4%) swpO=0 conn=3 myRSS=3354 php=6 phpRSS=423 ap=27 tcp=35 topuser=madalice 2026-08-31 22:35:07 L1=1.66 run=8 blk=0 avail=7097 (51.5%) swpO=0 conn=2 myRSS=3354 php=9 phpRSS=1059 ap=23 tcp=38 topuser=madalice 2026-08-31 22:35:09 L1=2.17 run=14 blk=0 avail=6511 (47.3%) swpO=64 conn=9 myRSS=3353 php=12 phpRSS=1680 ap=26 tcp=45 topuser=madalice