INCIDENT 2026-09-02 02:42:26 trigger: php_rss=1630MB ================================================================== load: 3.44 1.32 1.01 13/677 723593 ncpu:10 mem_avail: 6527MB/13777MB (47.4%) swap_used:2312MB swapout:0/s blocked(D):0 running:20 iowait:0.1% steal:0.0% php: 18 procs / 1630MB heaviest user: tubesupplies (15 procs, 1503MB) apache: 49 procs tcp_estab: 123 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3333 root 256 1230 nobody 48 963 tubesupplies 10 962 mailman 20 403 netdata 7 200 wp-toolkit 3 63 cpanellogin 1 63 dovenull 6 46 kurri 3 42 infinium 3 42 mailnull 2 30 lowrange 2 29 evolution 7 25 dovecot 3 19 zabbix 1 17 aaa 1 14 named 1 12 polkitd 1 4 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB tubesupplies 10 980 root 1 28 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5468 MB Active(file): 4243 MB Inactive(file): 1123 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 643 MB CommitLimit: 10984 MB Committed_AS: 8788 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-00:19:58 3376 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3413572 10.5 Ssl 5-00:23:18 /usr/sbin/mariadbd 508924 1 netdata 178964 1.9 Ssl 5-00:22:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 655564 1 root 175896 0.3 Ss 19:04 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 706070 655564 root 169856 0.0 S 04:28 spamd child 706071 655564 root 168196 0.0 S 04:28 spamd child 723536 723458 tubesupplies 152844 47.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 723509 723448 tubesupplies 151676 37.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 723543 722348 tubesupplies 136768 44.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 134752 0.0 Ss 5-00:22:44 /usr/lib/systemd/systemd-journald 723535 705320 tubesupplies 132776 39.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 723534 723515 tubesupplies 132384 32.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 723554 723469 tubesupplies 94516 70.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 723551 723471 tubesupplies 91336 32.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 77276 0.0 Sl 5-00:22:42 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 723558 723524 tubesupplies 75056 46.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 723555 723516 tubesupplies 69188 40.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 723557 723525 tubesupplies 68648 38.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 704828 1353308 cpanellogin 64708 0.1 S 06:32 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 44280 0.0 Sl 5-00:22:44 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42012 0.1 Ss 42-00:01:10 cpsrvd (SSL) - waiting for connections 1469 1 root 41688 0.1 Ss 64-16:32:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 723576 1469 root 38916 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929420 1 wp-toolkit 38024 0.0 Ss 1-00:19:49 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 37260 0.0 Ss 19:35 lfd - sleeping 3929444 1 root 29120 0.0 Ss 1-00:19:49 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 705694 506832 nobody 26468 0.1 S 04:50 /usr/sbin/httpd -k start 689681 506832 nobody 25992 0.0 S 09:03 /usr/sbin/httpd -k start 705309 506832 nobody 25732 0.0 S 05:36 /usr/sbin/httpd -k start 705310 506832 nobody 25520 0.1 S 05:36 /usr/sbin/httpd -k start 715831 506832 nobody 24372 0.0 S 02:19 /usr/sbin/httpd -k start 1463 1 root 24364 0.0 Ss 64-16:32:39 tailwatchd 3929564 1 wp-toolkit 24280 0.0 Ss 1-00:19:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 705320 506832 nobody 23580 0.0 S 05:35 /usr/sbin/httpd -k start 722524 704819 root 23524 0.0 S 01:29 /usr/sbin/exim -q 705332 506832 nobody 23372 0.0 S 05:35 /usr/sbin/httpd -k start 722746 506832 nobody 23140 0.0 S 01:11 /usr/sbin/httpd -k start 722079 506832 nobody 22244 0.0 S 02:04 /usr/sbin/httpd -k start 722348 506832 nobody 22144 0.0 S 01:38 /usr/sbin/httpd -k start 722791 506832 nobody 22028 0.1 S 01:09 /usr/sbin/httpd -k start 722389 506832 nobody 22020 0.0 S 01:34 /usr/sbin/httpd -k start 722198 506832 nobody 21992 0.0 S 01:51 /usr/sbin/httpd -k start 654699 654679 mailman 21748 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 654686 654679 mailman 21716 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 654700 654679 mailman 21688 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 654684 654679 mailman 21672 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654688 654679 mailman 21620 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 654695 654679 mailman 21616 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 654690 654679 mailman 21588 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 654693 654679 mailman 21536 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 654687 654679 mailman 21500 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 722367 506832 nobody 21492 0.1 S 01:36 /usr/sbin/httpd -k start 654692 654679 mailman 21464 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 654689 654679 mailman 21456 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 654696 654679 mailman 21448 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 654683 654679 mailman 21432 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 654685 654679 mailman 21416 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 654698 654679 mailman 21408 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 654694 654679 mailman 21356 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 654697 654679 mailman 21356 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 654691 654679 mailman 21352 0.0 S 19:44 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15529062 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 15529061 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au 133 aaa/aaadownunder.com.au-ssl_log 126 evolution/app.evolutionerp.com.au-ssl_log 74 coscom/coscom.com.au-ssl_log 46 vinesit/vinesit.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 17 madalice/madalice.com.au-ssl_log 6 tubesupplies/tubesupplies.com.au-ssl_log 3 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 133 20.151.10.161 119 158.23.18.78 74 40.115.94.245 46 20.48.250.41 34 20.48.251.3 17 203.54.180.238 3 118.127.40.55 2 91.92.243.248 2 91.92.243.234 2 209.141.33.142 2 114.119.137.101 1 2a03:2880:f802:15:: 1 216.73.217.60 1 209.141.57.84 1 17.166.22.54 --- top request paths across all vhosts (last 3 min) --- 74 GET /api/getItem/LWFBW2001KG 17 GET /heartbeat.php 5 POST /wp-login.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /this_is_a_new_hello_world.php 4 GET /w.php 4 GET /wp-content/themes/index.php 4 GET /admin.php 3 POST /wp-cron.php 3 GET /store/custom-af1-drippy-swoosh/ 3 GET /simple.php 3 GET /css.php 3 GET /ccc.php 3 GET /av.php 2 GET /xnm-apc.php 2 GET /xiugai.php 2 GET /xamp.php 2 GET /wp-temp.php 2 GET /wp.php 2 GET /wp-manager.php --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au == -- top paths -- 2 GET /wp-content/themes/index.php 1 GET /xs.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET //wp-includes/Requests/ 1 GET //wp-includes/l10n/ -- last 10 requests -- 20.151.10.161 - - [02/Sep/2026:02:40:47 +1000] "GET /qazwsx.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:47 +1000] "GET /cae2.2.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:48 +1000] "GET /b8.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:48 +1000] "GET /xs.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:48 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:48 +1000] "GET /wp_blog_footer.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:48 +1000] "GET /billzgs.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:49 +1000] "GET /ded.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:49 +1000] "GET /CAE-2.5.php HTTP/1.1" 404 - "-" "-" 20.151.10.161 - - [02/Sep/2026:02:40:49 +1000] "GET /0.php HTTP/1.1" 404 - "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 3 POST /wp-login.php 3 GET /admin.php 2 POST /wp-cron.php 2 GET /wp-login.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php -- last 10 requests -- 158.23.18.78 - - [02/Sep/2026:02:41:49 +1000] "GET /wp-includes/l10n/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:49 +1000] "GET /wp-manager.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:50 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:50 +1000] "GET /cgi-bin/admin.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:50 +1000] "GET /wp-content/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:51 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:51 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:51 +1000] "GET /wp-includes/assets/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:52 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [02/Sep/2026:02:41:52 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 401 36 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 74 GET /api/getItem/LWFBW2001KG -- last 10 requests -- 40.115.94.245 - - [02/Sep/2026:02:41:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:11 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:11 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:12 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:12 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:12 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:13 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:41:13 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-02 02:40:05 L1=0.51 run=3 blk=0 avail=7900 (57.3%) swpO=0 conn=2 myRSS=3333 php=3 phpRSS=195 ap=14 tcp=32 topuser=madalice 2026-09-02 02:40:05 L1=0.51 run=4 blk=0 avail=7883 (57.2%) swpO=0 conn=1 myRSS=3333 php=4 phpRSS=239 ap=14 tcp=36 topuser=madalice 2026-09-02 02:40:15 L1=0.58 run=1 blk=0 avail=7878 (57.2%) swpO=0 conn=2 myRSS=3333 php=3 phpRSS=192 ap=18 tcp=32 topuser=madalice 2026-09-02 02:40:15 L1=0.58 run=1 blk=0 avail=7866 (57.1%) swpO=0 conn=1 myRSS=3333 php=4 phpRSS=232 ap=18 tcp=33 topuser=madalice 2026-09-02 02:40:25 L1=0.49 run=1 blk=0 avail=7862 (57.1%) swpO=1 conn=2 myRSS=3333 php=3 phpRSS=192 ap=21 tcp=37 topuser=madalice 2026-09-02 02:40:25 L1=0.49 run=1 blk=0 avail=7851 (57.0%) swpO=1 conn=2 myRSS=3333 php=4 phpRSS=232 ap=21 tcp=39 topuser=madalice 2026-09-02 02:40:35 L1=0.41 run=1 blk=0 avail=7848 (57.0%) swpO=0 conn=2 myRSS=3333 php=3 phpRSS=192 ap=22 tcp=41 topuser=madalice 2026-09-02 02:40:35 L1=0.41 run=3 blk=0 avail=7830 (56.8%) swpO=0 conn=2 myRSS=3333 php=4 phpRSS=232 ap=22 tcp=42 topuser=madalice 2026-09-02 02:40:45 L1=0.43 run=1 blk=0 avail=7847 (57.0%) swpO=0 conn=1 myRSS=3333 php=3 phpRSS=192 ap=22 tcp=38 topuser=madalice 2026-09-02 02:40:45 L1=0.43 run=1 blk=0 avail=7834 (56.9%) swpO=0 conn=2 myRSS=3333 php=4 phpRSS=232 ap=22 tcp=41 topuser=madalice 2026-09-02 02:40:55 L1=0.36 run=2 blk=0 avail=7841 (56.9%) swpO=0 conn=1 myRSS=3333 php=5 phpRSS=231 ap=25 tcp=43 topuser=madalice 2026-09-02 02:40:55 L1=0.33 run=1 blk=0 avail=7834 (56.9%) swpO=0 conn=2 myRSS=3333 php=5 phpRSS=238 ap=25 tcp=40 topuser=madalice 2026-09-02 02:41:05 L1=0.31 run=2 blk=0 avail=7776 (56.4%) swpO=0 conn=1 myRSS=3333 php=5 phpRSS=354 ap=19 tcp=32 topuser=madalice 2026-09-02 02:41:05 L1=0.36 run=2 blk=0 avail=7744 (56.2%) swpO=0 conn=2 myRSS=3333 php=6 phpRSS=419 ap=18 tcp=32 topuser=madalice 2026-09-02 02:41:15 L1=0.49 run=1 blk=0 avail=7765 (56.4%) swpO=0 conn=1 myRSS=3333 php=5 phpRSS=355 ap=18 tcp=37 topuser=madalice 2026-09-02 02:41:16 L1=0.61 run=3 blk=0 avail=7713 (56.0%) swpO=0 conn=2 myRSS=3333 php=7 phpRSS=460 ap=19 tcp=38 topuser=madalice 2026-09-02 02:41:25 L1=0.97 run=2 blk=0 avail=7696 (55.9%) swpO=0 conn=1 myRSS=3333 php=6 phpRSS=446 ap=20 tcp=34 topuser=madalice 2026-09-02 02:41:26 L1=0.89 run=3 blk=0 avail=7731 (56.1%) swpO=0 conn=2 myRSS=3333 php=6 phpRSS=409 ap=20 tcp=36 topuser=madalice 2026-09-02 02:41:35 L1=0.82 run=2 blk=0 avail=7817 (56.7%) swpO=0 conn=1 myRSS=3333 php=4 phpRSS=275 ap=20 tcp=37 topuser=madalice 2026-09-02 02:41:36 L1=0.91 run=3 blk=0 avail=7727 (56.1%) swpO=0 conn=2 myRSS=3333 php=5 phpRSS=395 ap=20 tcp=37 topuser=madalice 2026-09-02 02:41:45 L1=1.00 run=1 blk=0 avail=7862 (57.1%) swpO=0 conn=2 myRSS=3333 php=4 phpRSS=232 ap=19 tcp=33 topuser=madalice 2026-09-02 02:41:46 L1=0.92 run=2 blk=0 avail=7863 (57.1%) swpO=0 conn=2 myRSS=3333 php=4 phpRSS=232 ap=19 tcp=34 topuser=madalice 2026-09-02 02:41:55 L1=0.93 run=1 blk=0 avail=7851 (57.0%) swpO=0 conn=2 myRSS=3333 php=4 phpRSS=234 ap=19 tcp=35 topuser=madalice 2026-09-02 02:41:56 L1=0.85 run=1 blk=0 avail=7851 (57.0%) swpO=0 conn=2 myRSS=3333 php=4 phpRSS=234 ap=19 tcp=35 topuser=madalice 2026-09-02 02:42:05 L1=0.78 run=1 blk=0 avail=7794 (56.6%) swpO=0 conn=2 myRSS=3333 php=5 phpRSS=329 ap=19 tcp=31 topuser=madalice 2026-09-02 02:42:06 L1=0.80 run=2 blk=0 avail=7793 (56.6%) swpO=0 conn=2 myRSS=3333 php=5 phpRSS=330 ap=19 tcp=33 topuser=madalice 2026-09-02 02:42:15 L1=0.75 run=1 blk=0 avail=7877 (57.2%) swpO=0 conn=2 myRSS=3333 php=4 phpRSS=233 ap=17 tcp=33 topuser=madalice 2026-09-02 02:42:16 L1=0.75 run=3 blk=0 avail=7843 (56.9%) swpO=0 conn=2 myRSS=3333 php=5 phpRSS=295 ap=17 tcp=33 topuser=madalice 2026-09-02 02:42:26 L1=3.44 run=20 blk=0 avail=6527 (47.4%) swpO=0 conn=11 myRSS=3333 php=18 phpRSS=1630 ap=49 tcp=123 topuser=tubesupplies 2026-09-02 02:42:26 L1=3.44 run=14 blk=0 avail=7014 (50.9%) swpO=0 conn=9 myRSS=3333 php=12 phpRSS=1125 ap=49 tcp=123 topuser=tubesupplies