INCIDENT 2026-09-02 03:37:22 trigger: php_rss=1848MB ================================================================== load: 5.18 2.64 1.58 13/771 917157 ncpu:10 mem_avail: 5611MB/13777MB (40.7%) swap_used:2280MB swapout:0/s blocked(D):0 running:16 iowait:0.2% steal:0.0% php: 18 procs / 1848MB heaviest user: aaa (8 procs, 686MB) apache: 125 procs tcp_estab: 104 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3320 nobody 124 2394 root 262 1464 aaa 8 565 mailman 20 400 evolution 9 378 customc 2 321 madalice 2 269 netdata 7 202 alison 1 132 whiz 1 130 cpanellogin 1 116 wp-toolkit 3 62 dovenull 6 46 infinium 3 43 kurri 3 42 mailnull 3 34 lowrange 2 29 vinesit 2 27 dovecot 3 19 --- php workers by user --- USER PROCS RSS_MB aaa 6 557 evolution 3 361 customc 2 324 madalice 2 269 alison 1 136 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4670 MB Active(file): 3762 MB Inactive(file): 900 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 612 MB CommitLimit: 10984 MB Committed_AS: 11241 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-01:14:54 3364 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3400216 10.4 Ssl 5-01:18:14 /usr/sbin/mariadbd 706070 655564 root 193480 0.0 S 59:24 spamd child 508924 1 netdata 180972 1.9 Ssl 5-01:17:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 917061 911832 evolution 180960 46.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 917048 911245 evolution 180540 53.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 655564 1 root 175496 0.1 Ss 01:14:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 706071 655564 root 168064 0.0 S 59:24 spamd child 917110 894481 customc 155376 69.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 917059 912898 alison 147744 63.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 916332 3929444 madalice 140076 9.2 S 00:16 php-fpm: pool madalice_com_au 916392 3929444 madalice 135704 9.2 S 00:15 php-fpm: pool madalice_com_au 892861 892856 whiz 133912 3.0 Ssl 05:22 /usr/local/cpanel/bin/autossl_check --all 704828 1353308 cpanellogin 119348 0.1 S 01:01:28 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 917098 914693 aaa 98716 70.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 917097 915341 aaa 89676 61.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 78016 0.0 Sl 5-01:17:38 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 917090 894729 aaa 69068 72.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 44356 0.0 Sl 5-01:17:40 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41940 0.1 Ss 42-00:56:06 cpsrvd (SSL) - waiting for connections 1469 1 root 40948 0.1 Ss 64-17:27:35 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 917121 1469 root 38644 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 917178 1469 root 38640 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 917151 1469 root 38584 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 917152 1469 root 38500 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 915324 1469 root 37884 0.0 S 00:34 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 912846 1469 root 37840 0.0 S 01:05 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 915162 1469 root 37840 0.0 S 00:37 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 916592 1469 root 37840 0.0 S 00:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 897243 1469 root 37776 0.0 S 02:20 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 901152 1469 root 37776 0.0 S 02:17 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929420 1 wp-toolkit 37716 0.0 Ss 1-01:14:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 37264 0.0 Ss 01:14:31 lfd - sleeping 917194 1353308 root 35216 0.0 S 00:00 webmaild - serving 127.0.0.1 917200 1353308 root 35212 0.0 S 00:00 whostmgrd - serving 127.0.0.1 3929444 1 root 29112 0.0 Ss 1-01:14:45 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1466 1 root 25728 0.0 Ss 64-17:27:35 dnsadmin - server mode 1463 1 root 24896 0.0 Ss 64-17:27:35 tailwatchd 3929564 1 wp-toolkit 23900 0.0 Ss 1-01:14:44 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 894737 506832 nobody 23816 0.1 S 03:24 /usr/sbin/httpd -k start 876204 506832 nobody 23592 0.0 S 09:30 /usr/sbin/httpd -k start 892986 506832 nobody 23572 0.1 S 05:15 /usr/sbin/httpd -k start 911799 911780 root 23436 0.0 S 01:27 /usr/sbin/exim -q 911245 506832 nobody 23112 0.1 S 01:53 /usr/sbin/httpd -k start 893971 506832 nobody 23096 0.1 S 04:11 /usr/sbin/httpd -k start 895771 506832 nobody 22732 0.1 S 02:45 /usr/sbin/httpd -k start 909732 506832 nobody 22284 0.1 S 02:11 /usr/sbin/httpd -k start 895781 506832 nobody 22068 0.0 S 02:45 /usr/sbin/httpd -k start 911796 506832 nobody 22032 0.1 S 01:27 /usr/sbin/httpd -k start 911835 506832 nobody 21888 0.1 S 01:26 /usr/sbin/httpd -k start 894722 506832 nobody 21852 0.0 S 03:24 /usr/sbin/httpd -k start 894678 506832 nobody 21808 0.1 S 03:25 /usr/sbin/httpd -k start 894671 506832 nobody 21800 0.0 S 03:25 /usr/sbin/httpd -k start 911798 506832 nobody 21780 0.1 S 01:27 /usr/sbin/httpd -k start 913007 506832 nobody 21780 0.1 S 01:02 /usr/sbin/httpd -k start 894729 506832 nobody 21760 0.1 R 03:24 /usr/sbin/httpd -k start 894674 506832 nobody 21748 0.1 S 03:25 /usr/sbin/httpd -k start 654699 654679 mailman 21608 0.0 S 01:14:40 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 894481 506832 nobody 21600 0.1 S 03:39 /usr/sbin/httpd -k start 895742 506832 nobody 21584 0.0 S 02:46 /usr/sbin/httpd -k start 912032 506832 nobody 21584 0.0 S 01:21 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15551554 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min cosgrovecreative/cosgrovecreative.com.au-ssl_log 395 aaa/aaadownunder.com.au-ssl_log 390 madalice/madalice.com.au-ssl_log 369 lowrange/lowrange.com.au-ssl_log 288 customc/customcentral.com.au-ssl_log 282 infinium/infinium.net.au-ssl_log 280 kurri/kurrimotorinn.com.au-ssl_log 233 candyfabcom/candyfab.com.au-ssl_log 228 aaa/aaadownunder.com.au 204 olytis/tis.com.au-ssl_log 197 otter2/otterfencing.net.au-ssl_log 178 nrg/nrgservices.net.au-ssl_log 174 evolution/evolutionerp.com.au-ssl_log 160 coscom/coscom.com.au-ssl_log 127 alison/alisonarts.com.au-ssl_log 108 (total vhosts taking traffic: 36) --- top client IPs across all vhosts (last 3 min) --- 254 192.168.0.2 214 159.89.174.87 197 130.12.180.117 173 159.223.132.86 119 167.172.232.142 113 165.227.39.235 98 164.90.208.56 96 130.12.182.254 94 178.128.207.138 94 139.59.143.102 93 87.58.197.201 93 159.89.127.165 88 64.226.65.160 88 209.38.248.17 88 206.81.24.74 --- top request paths across all vhosts (last 3 min) --- 754 GET / 140 GET /.env 113 GET /server-status 113 GET /server 113 GET /console/ 112 GET /about 111 GET /___proxy_subdomain_whm/login 111 GET /login.action 110 GET /v2/_catalog 109 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 109 GET /.DS_Store 107 GET /.git/config 106 POST /graphql 106 POST /api 104 POST /api/graphql 103 POST /api/gql 102 POST /graphql/api 102 GET /telescope/requests 101 GET /info.php 100 GET /.well-known/security.txt --- busiest 3 vhosts: top paths + last 10 requests --- == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 64 GET / 10 POST /graphql/api 10 POST /graphql 10 POST /api/graphql 10 POST /api/gql 10 POST /api 10 GET /v2/_catalog 10 GET /.git/config 10 GET /.env 10 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 10 GET /.DS_Store 9 GET /.well-known/security.txt -- last 10 requests -- 165.22.34.189 - - [02/Sep/2026:03:37:01 +1000] "OPTIONS / HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.99.210.137 - - [02/Sep/2026:03:37:01 +1000] "POST /api/graphql HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 134.209.25.199 - - [02/Sep/2026:03:37:01 +1000] "GET /trace.axd HTTP/1.1" 200 928 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 64.226.65.160 - - [02/Sep/2026:03:37:02 +1000] "GET /@vite/env HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 165.22.34.189 - - [02/Sep/2026:03:37:03 +1000] "GET /?rest_route=/wp/v2/users/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 134.209.25.199 - - [02/Sep/2026:03:37:03 +1000] "GET /@vite/env HTTP/1.1" 200 928 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.99.210.137 - - [02/Sep/2026:03:37:03 +1000] "POST /graphql/api HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 165.22.34.189 - - [02/Sep/2026:03:37:04 +1000] "GET /debug/default/view?panel=config HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 64.226.65.160 - - [02/Sep/2026:03:37:06 +1000] "OPTIONS / HTTP/1.1" 200 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.99.210.137 - - [02/Sep/2026:03:37:06 +1000] "POST /api/gql HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 31 GET / 17 GET /.env 10 GET /.git/HEAD 9 POST /graphql/api 9 POST /graphql 9 POST /api/graphql 9 POST /api/gql 9 POST /api 9 OPTIONS / 9 GET /.well-known/security.txt 9 GET /@vite/env 9 GET /trace.axd -- last 10 requests -- 46.101.1.225 - - [02/Sep/2026:03:37:21 +1000] "GET /?rest_route=/wp/v2/users/ HTTP/1.1" 200 1522 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:37:22 +1000] "LEAKIX" 404 - "-" "-" 158.69.55.148 - - [02/Sep/2026:03:37:21 +1000] "GET /index.php/category/uncategorized/ HTTP/1.1" 200 90443 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537 165.22.235.3 - - [02/Sep/2026:03:37:22 +1000] "LEAKIX" 404 - "-" "-" 158.69.55.148 - - [02/Sep/2026:03:37:21 +1000] "GET /index.php/2021/10/19/charlestown-swim-centre-piles/ HTTP/1.1" 200 64785 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 158.69.55.148 - - [02/Sep/2026:03:37:21 +1000] "GET /index.php/2021/09/12/brick-garden-beds/ HTTP/1.1" 200 68548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safa 158.69.55.148 - - [02/Sep/2026:03:37:22 +1000] "GET /index.php/2021/06/20/kahibah/ HTTP/1.1" 200 65060 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:37:21 +1000] "GET /index.php/2021/09/12/brick-garden-beds/ HTTP/1.1" 200 68548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safa 158.69.55.148 - - [02/Sep/2026:03:37:21 +1000] "GET /index.php/2025/05/23/maitland-full-house-pier-replacement/ HTTP/1.1" 200 63349 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 158.69.55.148 - - [02/Sep/2026:03:37:21 +1000] "GET /index.php/2021/10/19/charlestown-swim-centre-piles/ HTTP/1.1" 200 64785 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 == madalice/madalice.com.au-ssl_log == -- top paths -- 67 GET / 11 POST /graphql/api 11 POST /graphql 11 POST /api/graphql 11 POST /api/gql 11 POST /api 11 GET /.well-known/security.txt 11 GET /v2/_catalog 11 GET /trace.axd 11 GET /telescope/requests 11 GET /server-status 11 GET /server -- last 10 requests -- 143.110.217.244 - - [02/Sep/2026:03:36:58 +1000] "GET /info.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:36:58 +1000] "OPTIONS / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 143.110.217.244 - - [02/Sep/2026:03:36:59 +1000] "GET /.well-known/security.txt HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:37:00 +1000] "PROPFIND / HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:37:00 +1000] "OPTIONS / HTTP/1.1" 200 12487 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 143.110.217.244 - - [02/Sep/2026:03:37:01 +1000] "GET /actuator/env HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:37:02 +1000] "GET /?rest_route=/wp/v2/users/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:37:02 +1000] "GET /?rest_route=/wp/v2/users/ HTTP/1.1" 200 12483 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 143.110.217.244 - - [02/Sep/2026:03:37:02 +1000] "GET /trace.axd HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:37:03 +1000] "GET /debug/default/view?panel=config HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" --- last 30 samples (run-up to this incident) --- 2026-09-02 03:35:01 L1=1.96 run=4 blk=0 avail=7028 (51.0%) swpO=0 conn=1 myRSS=3330 php=6 phpRSS=451 ap=68 tcp=58 topuser=alison 2026-09-02 03:35:01 L1=2.05 run=18 blk=0 avail=7153 (51.9%) swpO=0 conn=3 myRSS=3330 php=5 phpRSS=409 ap=68 tcp=60 topuser=alison 2026-09-02 03:35:11 L1=1.96 run=6 blk=0 avail=7362 (53.4%) swpO=0 conn=1 myRSS=3330 php=3 phpRSS=194 ap=59 tcp=57 topuser=madalice 2026-09-02 03:35:11 L1=1.88 run=3 blk=0 avail=7362 (53.4%) swpO=0 conn=3 myRSS=3330 php=3 phpRSS=194 ap=59 tcp=66 topuser=madalice 2026-09-02 03:35:21 L1=2.13 run=5 blk=0 avail=7191 (52.2%) swpO=0 conn=1 myRSS=3330 php=7 phpRSS=523 ap=53 tcp=60 topuser=alison 2026-09-02 03:35:21 L1=2.28 run=5 blk=0 avail=7046 (51.1%) swpO=0 conn=3 myRSS=3330 php=7 phpRSS=687 ap=52 tcp=61 topuser=alison 2026-09-02 03:35:31 L1=2.34 run=10 blk=0 avail=6954 (50.5%) swpO=0 conn=1 myRSS=3330 php=8 phpRSS=621 ap=61 tcp=81 topuser=alison 2026-09-02 03:35:31 L1=3.04 run=4 blk=0 avail=7133 (51.8%) swpO=0 conn=3 myRSS=3330 php=5 phpRSS=475 ap=61 tcp=81 topuser=evolution 2026-09-02 03:35:41 L1=2.96 run=4 blk=0 avail=7182 (52.1%) swpO=3 conn=3 myRSS=3330 php=6 phpRSS=507 ap=53 tcp=61 topuser=madalice 2026-09-02 03:35:41 L1=2.96 run=5 blk=0 avail=7091 (51.5%) swpO=3 conn=3 myRSS=3330 php=7 phpRSS=635 ap=52 tcp=61 topuser=madalice 2026-09-02 03:35:51 L1=2.65 run=4 blk=0 avail=7301 (53.0%) swpO=1 conn=3 myRSS=3330 php=5 phpRSS=421 ap=45 tcp=51 topuser=madalice 2026-09-02 03:35:51 L1=2.65 run=3 blk=0 avail=7211 (52.3%) swpO=1 conn=3 myRSS=3330 php=7 phpRSS=563 ap=45 tcp=61 topuser=madalice 2026-09-02 03:36:01 L1=2.86 run=7 blk=0 avail=6512 (47.3%) swpO=104 conn=3 myRSS=3328 php=11 phpRSS=1085 ap=82 tcp=94 topuser=evolution 2026-09-02 03:36:02 L1=2.86 run=6 blk=0 avail=6254 (45.4%) swpO=95 conn=6 myRSS=3328 php=10 phpRSS=1253 ap=90 tcp=105 topuser=evolution 2026-09-02 03:36:11 L1=3.36 run=7 blk=0 avail=6311 (45.8%) swpO=62 conn=3 myRSS=3327 php=8 phpRSS=812 ap=134 tcp=103 topuser=madalice 2026-09-02 03:36:12 L1=3.36 run=4 blk=0 avail=6431 (46.7%) swpO=62 conn=6 myRSS=3327 php=7 phpRSS=638 ap=134 tcp=101 topuser=madalice 2026-09-02 03:36:21 L1=4.32 run=11 blk=0 avail=5501 (39.9%) swpO=115 conn=6 myRSS=3326 php=13 phpRSS=1649 ap=146 tcp=121 topuser=madalice 2026-09-02 03:36:22 L1=4.32 run=9 blk=1 avail=5821 (42.3%) swpO=464 conn=6 myRSS=3320 php=9 phpRSS=1189 ap=148 tcp=111 topuser=madalice 2026-09-02 03:36:32 L1=4.13 run=5 blk=0 avail=6490 (47.1%) swpO=0 conn=6 myRSS=3320 php=6 phpRSS=472 ap=145 tcp=92 topuser=madalice 2026-09-02 03:36:32 L1=4.13 run=8 blk=0 avail=6396 (46.4%) swpO=317 conn=6 myRSS=3320 php=8 phpRSS=613 ap=145 tcp=104 topuser=madalice 2026-09-02 03:36:42 L1=4.33 run=17 blk=0 avail=6025 (43.7%) swpO=0 conn=6 myRSS=3320 php=9 phpRSS=868 ap=153 tcp=123 topuser=madalice 2026-09-02 03:36:42 L1=4.33 run=12 blk=0 avail=5894 (42.8%) swpO=0 conn=8 myRSS=3320 php=11 phpRSS=1099 ap=153 tcp=117 topuser=customc 2026-09-02 03:36:52 L1=4.67 run=4 blk=0 avail=6353 (46.1%) swpO=0 conn=6 myRSS=3320 php=5 phpRSS=450 ap=153 tcp=117 topuser=madalice 2026-09-02 03:36:52 L1=4.67 run=3 blk=0 avail=6442 (46.8%) swpO=0 conn=8 myRSS=3320 php=4 phpRSS=353 ap=153 tcp=106 topuser=madalice 2026-09-02 03:37:02 L1=4.99 run=7 blk=0 avail=6262 (45.5%) swpO=0 conn=4 myRSS=3320 php=8 phpRSS=757 ap=144 tcp=103 topuser=madalice 2026-09-02 03:37:02 L1=4.99 run=4 blk=0 avail=6239 (45.3%) swpO=0 conn=8 myRSS=3320 php=7 phpRSS=724 ap=144 tcp=97 topuser=madalice 2026-09-02 03:37:12 L1=4.67 run=5 blk=0 avail=6355 (46.1%) swpO=0 conn=4 myRSS=3320 php=7 phpRSS=667 ap=134 tcp=83 topuser=evolution 2026-09-02 03:37:12 L1=4.67 run=4 blk=0 avail=6272 (45.5%) swpO=0 conn=8 myRSS=3320 php=7 phpRSS=741 ap=134 tcp=81 topuser=evolution 2026-09-02 03:37:22 L1=5.18 run=16 blk=0 avail=5611 (40.7%) swpO=0 conn=13 myRSS=3320 php=18 phpRSS=1848 ap=125 tcp=104 topuser=aaa 2026-09-02 03:37:22 L1=5.18 run=17 blk=0 avail=5877 (42.7%) swpO=0 conn=8 myRSS=3320 php=11 phpRSS=1165 ap=125 tcp=115 topuser=evolution