INCIDENT 2026-08-31 22:36:10 trigger: php_rss=1512MB ================================================================== load: 2.44 1.49 1.29 2/658 3165882 ncpu:10 mem_avail: 6692MB/13777MB (48.6%) swap_used:2302MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 12 procs / 1512MB heaviest user: madalice (9 procs, 1425MB) apache: 31 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3353 madalice 9 1425 root 242 950 nobody 30 508 netdata 7 207 infinium 3 143 cpanellogin 1 78 mailnull 5 68 mailman 20 66 dovenull 6 46 lowrange 2 29 evolution 7 29 zabbix 1 19 wp-toolkit 3 18 dovecot 3 18 aaa 1 15 alison 1 14 kurri 1 12 named 1 11 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 9 1425 infinium 1 64 root 1 21 evolution 1 10 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5416 MB Active(file): 3668 MB Inactive(file): 1997 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 502 MB CommitLimit: 10984 MB Committed_AS: 8394 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-20:17:31 3680 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3433524 9.3 Ssl 3-20:17:00 /usr/sbin/mariadbd 1247229 3002570 root 190248 0.1 S 09:06:01 spamd child 508924 1 netdata 187892 1.9 Ssl 3-20:16:29 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3156971 510022 madalice 163352 9.9 S 01:04 php-fpm: pool madalice_com_au 3159176 510022 madalice 163244 10.0 S 01:02 php-fpm: pool madalice_com_au 3165511 510022 madalice 162884 13.0 S 00:28 php-fpm: pool madalice_com_au 3158139 510022 madalice 162856 10.3 S 01:03 php-fpm: pool madalice_com_au 3156497 510022 madalice 162828 11.5 S 01:04 php-fpm: pool madalice_com_au 3156972 510022 madalice 162756 8.2 S 01:04 php-fpm: pool madalice_com_au 3159175 510022 madalice 162540 10.3 S 01:02 php-fpm: pool madalice_com_au 3036528 3002570 root 160584 0.0 S 20:04:28 spamd child 3165510 510022 madalice 159916 13.6 S 00:28 php-fpm: pool madalice_com_au 3165512 510022 madalice 159016 9.5 S 00:28 php-fpm: pool madalice_com_au 3002570 1 root 87484 0.0 Ss 20:13:24 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 84264 0.0 Ss 3-20:16:26 /usr/lib/systemd/systemd-journald 2197517 1353308 cpanellogin 79996 0.0 S 04:43:20 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3165853 3133336 infinium 77540 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509640 508992 root 72652 0.0 Sl 3-20:16:24 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 67904 0.0 Sl 3-20:16:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3165560 1353308 infinium 54576 0.6 S 00:20 webmaild - serving 1.41.252.211 1353308 1 root 41168 0.1 Ss 40-19:54:52 cpsrvd (SSL) - waiting for connections 3001917 1 root 33764 0.0 Ss 20:13:56 lfd - sleeping 3030978 938407 infinium 28824 0.0 S 36:56 php-fpm: pool user_infinium 3149718 506832 nobody 22424 0.0 S 02:34 /usr/sbin/httpd -k start 510022 1 root 22080 0.0 Ss 3-20:16:22 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3133336 506832 nobody 22004 0.2 S 07:35 /usr/sbin/httpd -k start 3150282 506832 nobody 21676 0.0 S 01:36 /usr/sbin/httpd -k start 1469 1 root 21072 0.1 Ss 63-12:26:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3150296 506832 nobody 21072 0.0 S 01:36 /usr/sbin/httpd -k start 3148138 506832 nobody 21024 0.2 S 05:47 /usr/sbin/httpd -k start 1463 1 root 21008 0.0 Ss 63-12:26:21 tailwatchd 3148842 506832 nobody 21000 0.1 S 04:15 /usr/sbin/httpd -k start 3150224 506832 nobody 20836 0.1 S 01:40 /usr/sbin/httpd -k start 3150257 506832 nobody 20808 0.1 S 01:37 /usr/sbin/httpd -k start 3150290 506832 nobody 20748 0.1 S 01:36 /usr/sbin/httpd -k start 483898 1 zabbix 20020 0.2 Ssl 3-20:17:43 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3150235 506832 nobody 19900 0.0 S 01:39 /usr/sbin/httpd -k start 3165441 506832 nobody 19800 0.0 S 00:34 /usr/sbin/httpd -k start 3150292 506832 nobody 19628 0.0 S 01:36 /usr/sbin/httpd -k start 3149228 506832 nobody 19136 0.0 S 03:35 /usr/sbin/httpd -k start 3165434 506832 nobody 19104 0.0 S 00:35 /usr/sbin/httpd -k start 3162555 506832 nobody 19076 0.1 S 01:00 /usr/sbin/httpd -k start 3149778 506832 nobody 18844 0.0 S 02:31 /usr/sbin/httpd -k start 3165506 506832 nobody 17988 0.0 S 00:29 /usr/sbin/httpd -k start 3165595 506832 nobody 17776 0.0 S 00:19 /usr/sbin/httpd -k start 3165603 506832 nobody 17244 0.0 S 00:17 /usr/sbin/httpd -k start 3165607 506832 nobody 17184 0.0 S 00:16 /usr/sbin/httpd -k start 3165611 506832 nobody 17116 0.0 S 00:16 /usr/sbin/httpd -k start 3165613 506832 nobody 17076 0.0 S 00:16 /usr/sbin/httpd -k start 3165600 506832 nobody 16932 0.0 S 00:18 /usr/sbin/httpd -k start 3165525 506832 nobody 16816 0.0 S 00:24 /usr/sbin/httpd -k start 3165609 506832 nobody 16684 0.2 S 00:16 /usr/sbin/httpd -k start 509671 508992 netdata 16632 2.1 Sl 3-20:16:24 /usr/libexec/netdata/plugins.d/apps.plugin 1 3165608 506832 nobody 16120 0.0 S 00:16 /usr/sbin/httpd -k start 3165604 506832 nobody 16060 0.0 S 00:17 /usr/sbin/httpd -k start 2856707 508511 aaa 15936 0.0 S 01:29:41 dovecot/imap 508720 1 mailnull 15808 0.0 Ss 3-20:16:33 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3098283 508511 lowrange 15360 0.0 S 19:12 dovecot/imap 2977131 508511 lowrange 15256 0.0 S 54:59 dovecot/imap 1471 1 root 15028 0.0 Ss 63-12:26:21 cPhulkd - processor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9968305 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min infinium/infinium.net.au-ssl_log 203 tubesupplies/tubesupplies.com.au-ssl_log 132 aaa/aaadownunder.com.au-ssl_log 127 customc/customcentral.com.au-ssl_log 70 madalice/madalice.com.au-ssl_log 65 cosgrovecreative/cosgrovecreative.com.au-ssl_log 43 infinium/infinium.net.au 40 evolution/my.evolutionerp.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 22 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 132 52.139.37.240 122 34.139.66.91 116 68.155.159.216 93 74.248.24.12 64 52.139.44.162 43 34.165.96.2 33 56.10.80.37 26 13.213.5.99 22 203.54.180.238 15 101.119.138.142 13 118.127.40.55 5 52.167.144.187 2 69.6.213.81 2 52.167.144.192 2 50.6.160.110 --- top request paths across all vhosts (last 3 min) --- 64 GET /autodiscover/autodiscover.xml 22 GET /heartbeat.php 20 GET /wp-login.php 19 POST /functions.php 13 POST /wp-login.php 9 POST /wp-cron.php 7 POST / 7 GET /index.php 7 GET / 3 POST /v1/graphql 3 POST /api/graphql 3 GET /wp-admin/images/index.php 3 GET /wp-admin/ 3 GET /about/function.php 2 POST /graphql 2 GET /zwso.php 2 GET /zafir1.php 2 GET /xmrlpc.php 2 GET /ww5.php 2 GET /wp-update.php --- busiest 3 vhosts: top paths + last 10 requests --- == infinium/infinium.net.au-ssl_log == -- top paths -- 14 GET /wp-login.php 11 POST /wp-login.php 6 POST /wp-cron.php 2 POST / 2 GET / 1 POST /wp-admin/admin-ajax.php 1 GET /zwso.php 1 GET /zup.php 1 GET /zafir1.php 1 GET /y.php 1 GET /xxx.php 1 GET /xmrlpc.php -- last 10 requests -- 68.155.159.216 - - [31/Aug/2026:22:35:53 +1000] "GET /wp-info.php HTTP/1.1" 403 13 "-" "-" 68.155.159.216 - - [31/Aug/2026:22:35:54 +1000] "GET /wp-wordfence-waf.php HTTP/1.1" 404 68225 "-" "-" 68.155.159.216 - - [31/Aug/2026:22:35:55 +1000] "GET /ws49.php HTTP/1.1" 404 68225 "-" "-" 68.155.159.216 - - [31/Aug/2026:22:35:56 +1000] "GET /xxx.php HTTP/1.1" 404 68225 "-" "-" 68.155.159.216 - - [31/Aug/2026:22:35:57 +1000] "GET /0x.php HTTP/1.1" 404 68225 "-" "-" 68.155.159.216 - - [31/Aug/2026:22:35:58 +1000] "GET /CDX1.php HTTP/1.1" 404 68225 "-" "-" 68.155.159.216 - - [31/Aug/2026:22:36:00 +1000] "GET /akcc.php HTTP/1.1" 404 68225 "-" "-" 68.155.159.216 - - [31/Aug/2026:22:36:01 +1000] "GET /control.php HTTP/1.1" 404 68225 "-" "-" 118.127.40.55 - - [31/Aug/2026:22:36:03 +1000] "POST /wp-cron.php?doing_wp_cron=1788179763.4185891151428222656250 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://infinium.net.au" 68.155.159.216 - - [31/Aug/2026:22:36:02 +1000] "GET /images/ HTTP/1.1" 404 68225 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /xl.php 1 GET /ws.php 1 GET /wso.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-login.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/index.php -- last 10 requests -- 52.139.37.240 - - [31/Aug/2026:22:35:22 +1000] "GET /wp-admin/images/chosen.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:23 +1000] "GET /wp-admin/install.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:23 +1000] "GET /wp-includes/js/tinymce/skins/lightgray/img/index.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 52.139.37.240 - - [31/Aug/2026:22:35:24 +1000] "GET /cgi-bin/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:25 +1000] "GET /wp-admin/css/colors/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:25 +1000] "GET /.well-known/classwithtostring.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [31/Aug/2026:22:35:26 +1000] "GET /wp-admin/js/about.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:26 +1000] "GET /comfunctions.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:27 +1000] "GET /images/class-config.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:22:35:28 +1000] "GET /wp-includes/widgets/include.php HTTP/1.1" 500 7309 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 GET /wp-login.php 2 GET /actuator/configprops 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-ftp.otterfencing.com.au 1 GET /wp-json/wp/v2/users/me 1 GET /wp-json 1 GET /web.config 1 GET /values.yaml 1 GET /v1/graphql -- last 10 requests -- 34.139.66.91 - - [31/Aug/2026:22:36:08 +1000] "GET /.ssh/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:08 +1000] "GET /ses.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:08 +1000] "GET /.ssh/id_dsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:08 +1000] "GET /.ssh/authorized_keys HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:08 +1000] "GET /.ssh/known_hosts HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:08 +1000] "GET /privatekey.key HTTP/1.1" 404 - "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:09 +1000] "GET /app/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:09 +1000] "GET /.streamlit/secrets.toml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:09 +1000] "GET /settings.py HTTP/1.1" 404 - "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.66.91 - - [31/Aug/2026:22:36:09 +1000] "GET /.pypirc HTTP/1.1" 404 - "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-31 22:33:47 L1=1.01 run=4 blk=0 avail=7777 (56.4%) swpO=1 conn=2 myRSS=3354 php=6 phpRSS=358 ap=22 tcp=25 topuser=infinium 2026-08-31 22:33:48 L1=1.09 run=2 blk=0 avail=7860 (57.1%) swpO=1 conn=2 myRSS=3354 php=4 phpRSS=238 ap=21 tcp=29 topuser=madalice 2026-08-31 22:33:57 L1=1.09 run=7 blk=0 avail=7827 (56.8%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=276 ap=18 tcp=24 topuser=madalice 2026-08-31 22:33:59 L1=1.00 run=1 blk=0 avail=8033 (58.3%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=58 ap=18 tcp=24 topuser=infinium 2026-08-31 22:34:07 L1=1.00 run=3 blk=0 avail=7976 (57.9%) swpO=0 conn=2 myRSS=3354 php=3 phpRSS=121 ap=18 tcp=25 topuser=infinium 2026-08-31 22:34:09 L1=0.92 run=2 blk=0 avail=8032 (58.3%) swpO=0 conn=1 myRSS=3354 php=2 phpRSS=32 ap=18 tcp=25 topuser=root 2026-08-31 22:34:17 L1=0.93 run=2 blk=0 avail=7865 (57.1%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=251 ap=18 tcp=24 topuser=madalice 2026-08-31 22:34:19 L1=0.93 run=1 blk=0 avail=7924 (57.5%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=162 ap=18 tcp=23 topuser=madalice 2026-08-31 22:34:27 L1=0.86 run=2 blk=0 avail=7847 (57.0%) swpO=0 conn=2 myRSS=3354 php=4 phpRSS=259 ap=18 tcp=30 topuser=madalice 2026-08-31 22:34:29 L1=0.95 run=4 blk=0 avail=7900 (57.3%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=162 ap=19 tcp=32 topuser=madalice 2026-08-31 22:34:37 L1=1.03 run=4 blk=0 avail=7472 (54.2%) swpO=0 conn=2 myRSS=3354 php=7 phpRSS=478 ap=49 tcp=49 topuser=customc 2026-08-31 22:34:39 L1=1.27 run=2 blk=1 avail=7352 (53.4%) swpO=0 conn=1 myRSS=3354 php=6 phpRSS=577 ap=47 tcp=54 topuser=corpkicks 2026-08-31 22:34:47 L1=1.41 run=6 blk=0 avail=7495 (54.4%) swpO=0 conn=2 myRSS=3354 php=6 phpRSS=511 ap=39 tcp=36 topuser=madalice 2026-08-31 22:34:49 L1=1.54 run=1 blk=0 avail=7757 (56.3%) swpO=0 conn=1 myRSS=3354 php=3 phpRSS=186 ap=37 tcp=32 topuser=madalice 2026-08-31 22:34:57 L1=1.49 run=1 blk=0 avail=7794 (56.6%) swpO=0 conn=2 myRSS=3354 php=3 phpRSS=186 ap=29 tcp=35 topuser=madalice 2026-08-31 22:34:59 L1=1.45 run=5 blk=0 avail=7629 (55.4%) swpO=0 conn=3 myRSS=3354 php=6 phpRSS=423 ap=27 tcp=35 topuser=madalice 2026-08-31 22:35:07 L1=1.66 run=8 blk=0 avail=7097 (51.5%) swpO=0 conn=2 myRSS=3354 php=9 phpRSS=1059 ap=23 tcp=38 topuser=madalice 2026-08-31 22:35:09 L1=2.17 run=14 blk=0 avail=6511 (47.3%) swpO=64 conn=9 myRSS=3353 php=12 phpRSS=1680 ap=26 tcp=45 topuser=madalice 2026-08-31 22:35:17 L1=2.14 run=3 blk=0 avail=6726 (48.8%) swpO=86 conn=3 myRSS=3353 php=12 phpRSS=1465 ap=33 tcp=40 topuser=madalice 2026-08-31 22:35:20 L1=2.14 run=4 blk=0 avail=6736 (48.9%) swpO=19 conn=9 myRSS=3353 php=12 phpRSS=1475 ap=30 tcp=35 topuser=madalice 2026-08-31 22:35:27 L1=2.04 run=3 blk=0 avail=6698 (48.6%) swpO=0 conn=2 myRSS=3353 php=12 phpRSS=1509 ap=23 tcp=30 topuser=madalice 2026-08-31 22:35:30 L1=2.04 run=3 blk=0 avail=6779 (49.2%) swpO=0 conn=9 myRSS=3353 php=12 phpRSS=1481 ap=23 tcp=34 topuser=madalice 2026-08-31 22:35:37 L1=1.95 run=3 blk=0 avail=6884 (50.0%) swpO=0 conn=2 myRSS=3353 php=10 phpRSS=1303 ap=26 tcp=36 topuser=madalice 2026-08-31 22:35:40 L1=1.95 run=2 blk=0 avail=6947 (50.4%) swpO=0 conn=9 myRSS=3353 php=10 phpRSS=1247 ap=26 tcp=29 topuser=madalice 2026-08-31 22:35:47 L1=2.84 run=5 blk=0 avail=6436 (46.7%) swpO=1 conn=4 myRSS=3353 php=14 phpRSS=1830 ap=30 tcp=41 topuser=madalice 2026-08-31 22:35:50 L1=2.84 run=5 blk=0 avail=6411 (46.5%) swpO=1 conn=3 myRSS=3353 php=13 phpRSS=1810 ap=30 tcp=42 topuser=madalice 2026-08-31 22:35:57 L1=2.79 run=4 blk=0 avail=6231 (45.2%) swpO=0 conn=5 myRSS=3353 php=15 phpRSS=1959 ap=44 tcp=42 topuser=madalice 2026-08-31 22:36:00 L1=2.79 run=3 blk=0 avail=6415 (46.6%) swpO=0 conn=1 myRSS=3353 php=13 phpRSS=1741 ap=41 tcp=38 topuser=madalice 2026-08-31 22:36:07 L1=2.44 run=3 blk=0 avail=6653 (48.3%) swpO=0 conn=3 myRSS=3353 php=13 phpRSS=1563 ap=34 tcp=37 topuser=madalice 2026-08-31 22:36:10 L1=2.44 run=2 blk=0 avail=6692 (48.6%) swpO=0 conn=2 myRSS=3353 php=12 phpRSS=1512 ap=31 tcp=32 topuser=madalice