INCIDENT 2026-09-02 03:38:24 trigger: php_procs=44 php_rss=5030MB mysql_conn=39 ================================================================== load: 15.52 5.49 2.59 52/816 920108 ncpu:10 mem_avail: 3134MB/13777MB (22.8%) swap_used:2314MB swapout:973/s blocked(D):0 running:52 iowait:0.4% steal:0.0% php: 44 procs / 5030MB heaviest user: madalice (10 procs, 1893MB) apache: 154 procs tcp_estab: 103 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 153 3336 mysql 1 3275 madalice 10 1956 root 256 1340 alison 13 1250 evolution 12 465 speedlin 5 463 mailman 20 387 tubesupplies 3 351 netdata 7 204 olympic 1 125 cpanellogin 1 121 infinium 1 93 dovenull 6 63 wp-toolkit 3 60 otterfencing 1 54 mailnull 3 34 kurri 2 28 dovecot 2 20 zabbix 1 17 --- php workers by user --- USER PROCS RSS_MB madalice 10 1962 alison 13 1265 speedlin 5 464 evolution 6 455 tubesupplies 3 352 olympic 1 126 infinium 1 97 otterfencing 1 55 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3054 MB Active(file): 1479 MB Inactive(file): 591 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 485 MB CommitLimit: 10984 MB Committed_AS: 15801 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-01:15:57 2952 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3354332 10.4 Ssl 5-01:19:17 /usr/sbin/mariadbd 918068 3929444 madalice 263616 23.7 R 00:53 php-fpm: pool madalice_com_au 918981 3929444 madalice 250872 28.4 S 00:25 php-fpm: pool madalice_com_au 916332 3929444 madalice 230716 18.6 R 01:19 php-fpm: pool madalice_com_au 918434 3929444 madalice 202224 18.7 R 00:48 php-fpm: pool madalice_com_au 706070 655564 root 193448 0.0 S 01:00:27 spamd child 918184 3929444 madalice 185884 24.5 R 00:52 php-fpm: pool madalice_com_au 918432 3929444 madalice 185172 20.4 R 00:49 php-fpm: pool madalice_com_au 508924 1 netdata 183076 1.9 Ssl 5-01:18:46 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 655564 1 root 175496 0.1 Ss 01:15:03 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 706071 655564 root 167848 0.0 S 01:00:27 spamd child 918119 3929444 madalice 164988 21.0 R 00:52 php-fpm: pool madalice_com_au 918948 3929444 madalice 163576 30.5 R 00:26 php-fpm: pool madalice_com_au 918398 3929444 madalice 163524 22.6 R 00:49 php-fpm: pool madalice_com_au 918355 3929444 madalice 162852 18.3 R 00:50 php-fpm: pool madalice_com_au 919579 918814 speedlin 160328 16.2 S 00:11 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919807 918787 evolution 158616 18.2 R 00:05 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 919630 918774 alison 156856 17.4 R 00:10 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919788 919664 evolution 155084 18.8 R 00:05 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 919571 918743 alison 150388 22.5 R 00:11 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919711 918903 tubesupplies 135568 19.2 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919712 919314 olympic 134028 21.2 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919774 919313 alison 133592 31.1 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919815 919251 alison 133488 29.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919670 918840 speedlin 129388 17.5 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919655 918913 tubesupplies 128940 19.9 R 00:10 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 704828 1353308 cpanellogin 124748 0.1 S 01:02:31 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 919927 919624 infinium 108652 15.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 919710 918829 tubesupplies 107796 15.2 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919814 918891 alison 107716 24.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919767 919202 speedlin 103436 17.1 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919836 918896 alison 99092 24.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919821 919668 alison 93768 28.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919773 918788 alison 92316 19.0 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919890 918786 alison 88404 20.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919832 918497 alison 88300 15.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 920003 918778 evolution 83212 13.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 920001 918919 speedlin 82116 30.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 78016 0.0 Sl 5-01:18:41 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 919993 918783 alison 74232 33.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 920014 919249 evolution 72864 7.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 919990 918749 alison 69752 25.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 919907 918906 alison 68608 16.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 920024 919787 otterfencing 57992 14.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 920121 918728 vinesit 52224 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 920149 918895 speedlin 45440 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 43128 0.0 Sl 5-01:18:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41940 0.1 Ss 42-00:57:09 cpsrvd (SSL) - waiting for connections 920148 918750 vinesit 41208 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3929420 1 wp-toolkit 37280 0.0 Ss 1-01:15:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1469 1 root 37128 0.1 Ss 64-17:28:38 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 920155 1469 root 36208 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 920159 1469 root 36136 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 920158 1469 root 35108 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 654927 1 root 34348 0.0 Ss 01:15:34 lfd - sleeping 920135 1353308 root 33484 0.0 R 00:00 whostmgrd - serving 127.0.0.1 920166 1469 root 32820 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 29096 0.0 Ss 1-01:15:48 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 919770 1463 root 27116 2.6 S 00:06 tailwatchd - chkservd - named check 918731 506832 nobody 25244 0.2 S 00:31 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 920105 D - /usr/local/cpanel/scripts/restartsrv_pdns --check --notconfigured-ok --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15552364 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 15552326 | madalice_wp | madalice_wp | Query | 0 | Opening tables | UPDATE `AMuqf6qZ_options` SET `option_value` = 'a:530:{s:24:\"^wc-auth/v([1]{1})/(.*)?\";s:63:\"index.php?wc-auth-version=$matches[1]&wc-auth-route=$matches[2]\";s:21:\"^wc/file/transient/?$\";s:33:\"index.php?wc-transient-file-name=\";s:24:\"^wc/file/transient/(.+)$\";s:44:\"index.php?wc-transient- | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 669 aaa/aaadownunder.com.au-ssl_log 599 lowrange/lowrange.com.au-ssl_log 449 kurri/kurrimotorinn.com.au-ssl_log 434 infinium/infinium.net.au-ssl_log 301 cosgrovecreative/cosgrovecreative.com.au-ssl_log 286 otter2/otterfencing.net.au-ssl_log 269 customc/customcentral.com.au-ssl_log 265 candyfabcom/candyfab.com.au-ssl_log 224 olytis/tis.com.au-ssl_log 220 evolution/evolutionerp.com.au-ssl_log 212 nrg/nrgservices.net.au-ssl_log 179 aaa/aaadownunder.com.au 167 alison/alisonarts.com.au-ssl_log 133 evolution/app.evolutionerp.com.au-ssl_log 120 (total vhosts taking traffic: 43) --- top client IPs across all vhosts (last 3 min) --- 332 158.69.55.148 217 159.89.174.87 209 159.223.132.86 191 158.69.55.82 186 158.69.117.45 171 130.12.180.117 160 192.168.0.2 148 139.59.143.102 139 130.12.182.254 130 64.226.65.160 125 165.22.34.189 120 40.115.94.245 120 209.38.248.17 119 207.154.197.113 119 165.227.39.235 --- top request paths across all vhosts (last 3 min) --- 1529 GET / 212 GET /.env 145 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 143 GET /.git/config 141 POST /graphql 141 GET /v2/_catalog 140 GET /.DS_Store 137 POST /api 137 GET /___proxy_subdomain_whm/login 136 GET /login.action 135 GET /server-status 135 GET /about 134 POST /api/graphql 133 POST /graphql/api 130 POST /api/gql 128 GET /server 128 GET /console/ 127 GET /___proxy_subdomain_cpanel 121 GET /telescope/requests 120 GET /info.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 138 GET / 35 GET /.env 27 GET /server-status 27 GET /___proxy_subdomain_whm/login 27 GET /login.action 26 GET /v2/_catalog 26 GET /about 25 GET /server 25 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 25 GET /.DS_Store 25 GET /console/ 24 GET /___proxy_subdomain_cpanel -- last 10 requests -- 159.89.12.166 - - [02/Sep/2026:03:38:34 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 138.197.191.87 - - [02/Sep/2026:03:38:34 +1000] "GET /@vite/env HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.6313e25373e27363e2237313; +https://leakix.net)" 139.59.143.102 - - [02/Sep/2026:03:38:35 +1000] "POST /graphql/api HTTP/1.1" 400 - "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 164.92.107.174 - - [02/Sep/2026:03:38:35 +1000] "GET /debug/default/view?panel=config HTTP/1.1" 200 273 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430313; +https://leakix.net)" 165.22.235.3 - - [02/Sep/2026:03:38:35 +1000] "GET /actuator/env HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.6313e25373e27363e2237313; +https://leakix.net)" 138.197.191.87 - - [02/Sep/2026:03:38:35 +1000] "GET /trace.axd HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.6313e25373e27363e2237313; +https://leakix.net)" 46.101.1.225 - - [02/Sep/2026:03:38:35 +1000] "GET /actuator/env HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430313; +https://leakix.net)" 159.223.132.86 - - [02/Sep/2026:03:38:35 +1000] "GET /actuator/env HTTP/1.1" 400 44 "-" "Mozilla/5.0 (l9scan/2.0.6313e25373e27363e2237313; +https://leakix.net)" 64.226.65.160 - - [02/Sep/2026:03:38:35 +1000] "POST /graphql/api HTTP/1.1" 400 - "-" "Mozilla/5.0 (l9scan/2.0.6313e25373e27363e2237313; +https://leakix.net)" 157.245.36.108 - - [02/Sep/2026:03:38:35 +1000] "GET /@vite/env HTTP/1.1" 200 273 "-" "Mozilla/5.0 (l9scan/2.0.6313e25373e27363e2237313; +https://leakix.net)" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 332 GET / 12 GET /.env 10 GET /.git/HEAD 7 POST /graphql/api 7 POST /graphql 7 POST /api/graphql 7 POST /api/gql 7 POST /api 7 GET /.well-known/security.txt 7 GET /@vite/env 7 GET /v2/_catalog 7 GET /trace.axd -- last 10 requests -- 147.182.149.75 - - [02/Sep/2026:03:38:35 +1000] "GET / HTTP/1.0" 404 - "-" "-" 64.226.65.160 - - [02/Sep/2026:03:38:35 +1000] "GET / HTTP/1.0" 404 - "-" "-" 165.22.235.3 - - [02/Sep/2026:03:38:35 +1000] "GET / HTTP/1.0" 404 - "-" "-" 146.190.63.248 - - [02/Sep/2026:03:38:35 +1000] "GET / HTTP/1.0" 404 - "-" "-" 207.154.197.113 - - [02/Sep/2026:03:38:36 +1000] "GET / HTTP/1.0" 404 - "-" "-" 207.154.197.113 - - [02/Sep/2026:03:38:36 +1000] "GET / HTTP/1.0" 404 - "-" "-" 64.23.218.208 - - [02/Sep/2026:03:38:36 +1000] "GET / HTTP/1.0" 404 - "-" "-" 206.81.24.227 - - [02/Sep/2026:03:38:36 +1000] "GET / HTTP/1.0" 404 - "-" "-" 206.81.24.227 - - [02/Sep/2026:03:38:36 +1000] "GET / HTTP/1.0" 404 - "-" "-" 206.81.24.227 - - [02/Sep/2026:03:38:36 +1000] "GET / HTTP/1.0" 404 - "-" "-" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 201 GET / 10 POST /graphql/api 10 POST /graphql 10 POST /api/graphql 10 POST /api/gql 10 POST /api 10 GET /v2/_catalog 10 GET /server-status 10 GET /server 10 GET /s/5353e20343e2732313e2831313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 10 GET /___proxy_subdomain_whm/login 10 GET /login.action -- last 10 requests -- 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=pl HTTP/1.1" 200 12765 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=pt_br HTTP/1.1" 200 12610 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=ro HTTP/1.1" 200 12632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=ru HTTP/1.1" 200 12945 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=uk HTTP/1.1" 200 12884 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=tr HTTP/1.1" 200 12715 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=pt HTTP/1.1" 200 12500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=ro HTTP/1.1" 200 12627 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=vi HTTP/1.1" 200 12696 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.82 - - [02/Sep/2026:03:38:23 +1000] "GET /?locale=th HTTP/1.1" 200 12875 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-02 03:36:02 L1=2.86 run=6 blk=0 avail=6254 (45.4%) swpO=95 conn=6 myRSS=3328 php=10 phpRSS=1253 ap=90 tcp=105 topuser=evolution 2026-09-02 03:36:11 L1=3.36 run=7 blk=0 avail=6311 (45.8%) swpO=62 conn=3 myRSS=3327 php=8 phpRSS=812 ap=134 tcp=103 topuser=madalice 2026-09-02 03:36:12 L1=3.36 run=4 blk=0 avail=6431 (46.7%) swpO=62 conn=6 myRSS=3327 php=7 phpRSS=638 ap=134 tcp=101 topuser=madalice 2026-09-02 03:36:21 L1=4.32 run=11 blk=0 avail=5501 (39.9%) swpO=115 conn=6 myRSS=3326 php=13 phpRSS=1649 ap=146 tcp=121 topuser=madalice 2026-09-02 03:36:22 L1=4.32 run=9 blk=1 avail=5821 (42.3%) swpO=464 conn=6 myRSS=3320 php=9 phpRSS=1189 ap=148 tcp=111 topuser=madalice 2026-09-02 03:36:32 L1=4.13 run=5 blk=0 avail=6490 (47.1%) swpO=0 conn=6 myRSS=3320 php=6 phpRSS=472 ap=145 tcp=92 topuser=madalice 2026-09-02 03:36:32 L1=4.13 run=8 blk=0 avail=6396 (46.4%) swpO=317 conn=6 myRSS=3320 php=8 phpRSS=613 ap=145 tcp=104 topuser=madalice 2026-09-02 03:36:42 L1=4.33 run=17 blk=0 avail=6025 (43.7%) swpO=0 conn=6 myRSS=3320 php=9 phpRSS=868 ap=153 tcp=123 topuser=madalice 2026-09-02 03:36:42 L1=4.33 run=12 blk=0 avail=5894 (42.8%) swpO=0 conn=8 myRSS=3320 php=11 phpRSS=1099 ap=153 tcp=117 topuser=customc 2026-09-02 03:36:52 L1=4.67 run=4 blk=0 avail=6353 (46.1%) swpO=0 conn=6 myRSS=3320 php=5 phpRSS=450 ap=153 tcp=117 topuser=madalice 2026-09-02 03:36:52 L1=4.67 run=3 blk=0 avail=6442 (46.8%) swpO=0 conn=8 myRSS=3320 php=4 phpRSS=353 ap=153 tcp=106 topuser=madalice 2026-09-02 03:37:02 L1=4.99 run=7 blk=0 avail=6262 (45.5%) swpO=0 conn=4 myRSS=3320 php=8 phpRSS=757 ap=144 tcp=103 topuser=madalice 2026-09-02 03:37:02 L1=4.99 run=4 blk=0 avail=6239 (45.3%) swpO=0 conn=8 myRSS=3320 php=7 phpRSS=724 ap=144 tcp=97 topuser=madalice 2026-09-02 03:37:12 L1=4.67 run=5 blk=0 avail=6355 (46.1%) swpO=0 conn=4 myRSS=3320 php=7 phpRSS=667 ap=134 tcp=83 topuser=evolution 2026-09-02 03:37:12 L1=4.67 run=4 blk=0 avail=6272 (45.5%) swpO=0 conn=8 myRSS=3320 php=7 phpRSS=741 ap=134 tcp=81 topuser=evolution 2026-09-02 03:37:22 L1=5.18 run=16 blk=0 avail=5611 (40.7%) swpO=0 conn=13 myRSS=3320 php=18 phpRSS=1848 ap=125 tcp=104 topuser=aaa 2026-09-02 03:37:22 L1=5.18 run=17 blk=0 avail=5877 (42.7%) swpO=0 conn=8 myRSS=3320 php=11 phpRSS=1165 ap=125 tcp=115 topuser=evolution 2026-09-02 03:37:33 L1=5.74 run=22 blk=0 avail=5966 (43.3%) swpO=0 conn=14 myRSS=3320 php=19 phpRSS=1661 ap=114 tcp=139 topuser=customc 2026-09-02 03:37:33 L1=5.74 run=27 blk=0 avail=5912 (42.9%) swpO=0 conn=14 myRSS=3320 php=18 phpRSS=1643 ap=114 tcp=170 topuser=customc 2026-09-02 03:37:43 L1=6.37 run=3 blk=0 avail=6861 (49.8%) swpO=623 conn=1 myRSS=3301 php=11 phpRSS=1304 ap=37 tcp=171 topuser=madalice 2026-09-02 03:37:43 L1=6.37 run=1 blk=0 avail=7014 (50.9%) swpO=623 conn=14 myRSS=3301 php=10 phpRSS=1162 ap=37 tcp=167 topuser=madalice 2026-09-02 03:37:53 L1=5.47 run=6 blk=0 avail=6781 (49.2%) swpO=0 conn=1 myRSS=3301 php=11 phpRSS=1409 ap=19 tcp=257 topuser=madalice 2026-09-02 03:37:53 L1=5.47 run=3 blk=0 avail=6715 (48.7%) swpO=0 conn=14 myRSS=3301 php=11 phpRSS=1469 ap=19 tcp=263 topuser=madalice 2026-09-02 03:38:03 L1=6.84 run=11 blk=0 avail=5556 (40.3%) swpO=1 conn=12 myRSS=3301 php=20 phpRSS=2212 ap=110 tcp=223 topuser=madalice 2026-09-02 03:38:03 L1=6.84 run=21 blk=0 avail=5259 (38.2%) swpO=1 conn=16 myRSS=3301 php=23 phpRSS=2616 ap=110 tcp=193 topuser=madalice 2026-09-02 03:38:13 L1=9.53 run=34 blk=0 avail=4307 (31.3%) swpO=37 conn=26 myRSS=3301 php=30 phpRSS=3602 ap=137 tcp=115 topuser=madalice 2026-09-02 03:38:14 L1=9.53 run=35 blk=0 avail=4469 (32.4%) swpO=34 conn=25 myRSS=3301 php=30 phpRSS=3409 ap=139 tcp=123 topuser=madalice 2026-09-02 03:38:24 L1=15.52 run=52 blk=0 avail=3134 (22.8%) swpO=973 conn=39 myRSS=3275 php=44 phpRSS=5030 ap=154 tcp=103 topuser=madalice 2026-09-02 03:38:24 L1=15.52 run=51 blk=0 avail=3163 (23.0%) swpO=1071 conn=38 myRSS=3275 php=43 phpRSS=4879 ap=153 tcp=103 topuser=madalice 2026-09-02 03:38:35 L1=22.10 run=66 blk=0 avail=2968 (21.5%) swpO=0 conn=33 myRSS=3275 php=37 phpRSS=4741 ap=153 tcp=190 topuser=madalice