INCIDENT 2026-09-02 03:39:27 trigger: php_procs=30 php_rss=3859MB mysql_conn=27 ================================================================== load: 33.62 13.07 5.43 52/806 923399 ncpu:10 mem_avail: 3661MB/13777MB (26.6%) swap_used:2314MB swapout:0/s blocked(D):0 running:50 iowait:1.3% steal:0.0% php: 30 procs / 3859MB heaviest user: madalice (10 procs, 1885MB) apache: 153 procs tcp_estab: 115 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 154 3598 mysql 1 3275 madalice 10 1932 root 264 1567 speedlin 7 644 otterfencing 5 553 mailman 20 362 corpkicks 2 345 netdata 7 205 evolution 8 187 tubesupplies 2 128 alison 1 124 cpanellogin 1 110 aaa 2 84 dovenull 6 63 wp-toolkit 3 60 mailnull 2 29 kurri 2 28 dovecot 3 27 zabbix 1 19 --- php workers by user --- USER PROCS RSS_MB madalice 10 1936 speedlin 7 647 otterfencing 5 556 corpkicks 2 346 evolution 3 189 tubesupplies 2 131 alison 1 126 aaa 1 74 root 1 27 infinium 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2233 MB Active(file): 1006 MB Inactive(file): 500 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 473 MB CommitLimit: 10984 MB Committed_AS: 14984 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-01:17:00 2888 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3353888 10.4 Ssl 5-01:20:20 /usr/sbin/mariadbd 922540 918490 corpkicks 273432 9.3 R 00:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 918948 3929444 madalice 251132 23.7 R 01:29 php-fpm: pool madalice_com_au 918355 3929444 madalice 242848 21.3 R 01:53 php-fpm: pool madalice_com_au 916332 3929444 madalice 227120 21.2 S 02:22 php-fpm: pool madalice_com_au 918981 3929444 madalice 222636 22.6 R 01:28 php-fpm: pool madalice_com_au 918398 3929444 madalice 213972 23.9 R 01:52 php-fpm: pool madalice_com_au 918432 3929444 madalice 201200 21.7 R 01:52 php-fpm: pool madalice_com_au 706070 655564 root 193300 0.0 S 01:01:30 spamd child 508924 1 netdata 183740 1.9 Ssl 5-01:19:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 923280 919310 evolution 179984 49.0 S 00:03 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 923223 918728 otterfencing 177200 46.2 R 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 655564 1 root 175128 0.1 Ss 01:16:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 918068 3929444 madalice 169636 22.2 R 01:56 php-fpm: pool madalice_com_au 706071 655564 root 167788 0.0 S 01:01:30 spamd child 918434 3929444 madalice 167256 21.5 R 01:51 php-fpm: pool madalice_com_au 918119 3929444 madalice 162800 21.6 R 01:55 php-fpm: pool madalice_com_au 918184 3929444 madalice 159436 23.0 R 01:55 php-fpm: pool madalice_com_au 923256 918826 speedlin 145140 49.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923286 918783 alison 142872 55.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923148 918749 otterfencing 141728 24.1 R 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 923230 918747 speedlin 137528 33.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923155 919159 speedlin 130632 20.3 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923202 918827 otterfencing 125688 32.3 R 00:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 704828 1353308 cpanellogin 113060 0.2 S 01:03:34 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 923329 918616 corpkicks 93952 22.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 923307 919622 tubesupplies 92324 42.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 922478 922438 root 92044 3.7 R 00:27 /usr/bin/python3 /usr/local/cpanel/bin/packman_get_list_json all ea-php*-php-common 923242 918819 aaa 83952 15.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 77936 0.0 Sl 5-01:19:44 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 923326 918488 otterfencing 73176 16.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 923309 919251 otterfencing 71116 41.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 923344 918489 speedlin 69856 49.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923401 919306 infinium 60280 13.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 923383 919831 tubesupplies 53804 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923380 919320 speedlin 53344 15.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923389 919665 speedlin 48220 19.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923415 919664 otterfencing 45808 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 42440 0.0 Sl 5-01:19:46 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 923394 918786 evolution 40928 3.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 39428 0.1 Ss 42-00:58:12 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 36940 0.0 Ss 1-01:16:51 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 923395 1469 root 35848 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 923407 1469 root 35648 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 923435 1469 root 35580 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 34592 0.1 Ss 64-17:29:41 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 654927 1 root 34288 0.0 Ss 01:16:37 lfd - sleeping 923356 1469 root 33956 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 923434 1353308 root 33884 0.0 R 00:00 webmaild - serving 127.0.0.1 922380 1469 root 33796 0.0 S 00:28 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 923444 1353308 root 33724 0.0 S 00:00 cpaneld - serving 127.0.0.1 923448 1353308 root 33724 0.0 S 00:00 cpaneld - serving 127.0.0.1 921922 1469 root 33720 0.0 S 00:36 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 920208 1469 root 33436 0.0 S 01:03 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 923449 1353308 root 33420 0.0 S 00:00 webmaild - serving 127.0.0.1 923450 1353308 root 30172 0.0 R 00:00 cpsrvd (SSL) - waiting for connections 923443 1469 root 29416 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 28244 0.0 Ss 1-01:16:51 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 923451 1353308 root 27284 0.0 R 00:00 cpsrvd (SSL) - waiting for connections 923452 1353308 root 27284 0.0 R 00:00 cpsrvd (SSL) - waiting for connections --- processes in D state (uninterruptible IO) --- 922478 D - /usr/bin/python3 /usr/local/cpanel/bin/packman_get_list_json all ea-php*-php-common 922540 D - /opt/cpanel/ea-php83/root/usr/bin/php-cgi 923451 D - cpaneld - serving 127.0.0.1 --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15552937 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 628 madalice/madalice.com.au-ssl_log 580 otterfencing/otterfencing.com.au-ssl_log 402 lowrange/lowrange.com.au-ssl_log 346 kurri/kurrimotorinn.com.au-ssl_log 331 cosgrovecreative/cosgrovecreative.com.au-ssl_log 312 otter2/otterfencing.net.au-ssl_log 259 speedlin/speedlinefencing.com.au-ssl_log 225 nrg/nrgservices.net.au-ssl_log 199 alison/alisonarts.com.au-ssl_log 193 olytis/tis.com.au-ssl_log 186 otterfencing/otterfencing.com.au 184 infinium/infinium.net.au-ssl_log 170 evolution/evolutionerp.com.au-ssl_log 144 coscom/coscom.com.au-ssl_log 123 (total vhosts taking traffic: 38) --- top client IPs across all vhosts (last 3 min) --- 573 158.69.55.82 530 158.69.55.148 375 158.69.117.45 191 130.12.180.117 162 159.223.132.86 143 165.22.34.189 134 139.59.143.102 127 206.81.24.227 115 209.38.248.17 112 165.22.235.3 111 207.154.197.113 111 157.245.36.108 109 64.226.65.160 103 206.189.95.232 96 64.227.32.66 --- top request paths across all vhosts (last 3 min) --- 2088 GET / 143 GET /.env 108 POST /api/gql 105 POST /api/graphql 104 POST /graphql 102 POST /graphql/api 102 GET /telescope/requests 102 GET /info.php 101 POST /api 100 GET /.git/config 96 GET /actuator/env 94 GET /.well-known/security.txt 92 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 91 GET /trace.axd 91 GET /s/5353e20343e2732313e2831313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 91 GET /cgi-bin/ 88 GET /@vite/env 88 GET /debug/default/view 85 OPTIONS / 81 GET /v2/_catalog --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 468 GET / 4 POST /wp-json/batch/v1 4 POST / 4 OPTIONS / 4 GET /debug/default/view 3 GET /.well-known/security.txt 3 GET /@vite/env 3 GET /trace.axd 3 GET /telescope/requests 3 GET /info.php 3 GET /actuator/env 2 POST /api/gql -- last 10 requests -- 206.81.24.227 - - [02/Sep/2026:03:39:01 +1000] "GET / HTTP/1.0" 404 - "-" "-" 165.22.34.189 - - [02/Sep/2026:03:39:01 +1000] "GET / HTTP/1.0" 404 - "-" "-" 207.154.197.113 - - [02/Sep/2026:03:39:02 +1000] "GET / HTTP/1.0" 404 - "-" "-" 139.59.143.102 - - [02/Sep/2026:03:39:02 +1000] "GET / HTTP/1.0" 404 - "-" "-" 207.154.197.113 - - [02/Sep/2026:03:39:03 +1000] "GET / HTTP/1.0" 404 - "-" "-" 206.81.24.227 - - [02/Sep/2026:03:39:03 +1000] "GET / HTTP/1.0" 404 - "-" "-" 207.154.197.113 - - [02/Sep/2026:03:39:04 +1000] "GET / HTTP/1.0" 404 - "-" "-" 165.22.34.189 - - [02/Sep/2026:03:39:04 +1000] "GET / HTTP/1.0" 404 - "-" "-" 165.22.34.189 - - [02/Sep/2026:03:39:04 +1000] "GET / HTTP/1.0" 404 - "-" "-" 207.154.197.113 - - [02/Sep/2026:03:39:05 +1000] "GET / HTTP/1.0" 404 - "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 94 GET / 24 GET /.env 17 POST /graphql 17 POST /api/graphql 17 POST /api/gql 17 POST /api 17 GET /v2/_catalog 17 GET /info.php 17 GET /.git/config 17 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 17 GET /.DS_Store 16 POST /graphql/api -- last 10 requests -- 158.23.18.78 - - [02/Sep/2026:03:39:32 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 404 3421 "-" "-" 158.23.18.78 - - [02/Sep/2026:03:39:33 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 3421 "-" "-" 158.23.18.78 - - [02/Sep/2026:03:39:33 +1000] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 404 3421 "-" "-" 158.23.18.78 - - [02/Sep/2026:03:39:33 +1000] "GET /qazwsx.php HTTP/1.1" 404 3421 "-" "-" 158.23.18.78 - - [02/Sep/2026:03:39:34 +1000] "GET //elp.php?p= HTTP/1.1" 404 3421 "-" "-" 158.23.18.78 - - [02/Sep/2026:03:39:34 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 3421 "-" "-" 158.23.18.78 - - [02/Sep/2026:03:39:34 +1000] "GET /wp-comments-post.php HTTP/1.1" 404 3421 "-" "-" 209.38.248.17 - - [02/Sep/2026:03:38:58 +1000] "GET /s/438313e223e26323e2430313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1" 404 36689 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430 159.89.12.166 - - [02/Sep/2026:03:38:59 +1000] "GET /s/438313e233e26323e2430313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1" 404 36689 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430 158.23.18.78 - - [02/Sep/2026:03:39:35 +1000] "GET /kgblegacy.php HTTP/1.1" 404 3421 "-" "-" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 195 GET / 10 GET /server 10 GET /___proxy_subdomain_whm/login 10 GET /.env 10 GET /console/ 9 POST /graphql/api 9 POST /graphql 9 POST /api/graphql 9 POST /api/gql 9 POST /api 9 GET /telescope/requests 9 GET /server-status -- last 10 requests -- 64.227.32.66 - - [02/Sep/2026:03:39:33 +1000] "GET /trace.axd HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 164.92.244.132 - - [02/Sep/2026:03:39:34 +1000] "GET /telescope/requests HTTP/1.1" 301 302 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 206.81.24.74 - - [02/Sep/2026:03:39:35 +1000] "GET /actuator/env HTTP/1.1" 301 298 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 165.22.235.3 - - [02/Sep/2026:03:39:35 +1000] "OPTIONS / HTTP/1.1" 200 20 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 206.81.24.227 - - [02/Sep/2026:03:39:35 +1000] "OPTIONS / HTTP/1.1" 301 287 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 64.227.32.66 - - [02/Sep/2026:03:39:35 +1000] "GET /@vite/env HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 139.59.143.102 - - [02/Sep/2026:03:39:36 +1000] "GET /actuator/env HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 164.92.244.132 - - [02/Sep/2026:03:39:36 +1000] "GET /info.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 206.81.24.74 - - [02/Sep/2026:03:39:36 +1000] "GET /trace.axd HTTP/1.1" 301 295 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 206.81.24.227 - - [02/Sep/2026:03:39:36 +1000] "GET /?rest_route=/wp/v2/users/ HTTP/1.1" 301 312 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" --- last 30 samples (run-up to this incident) --- 2026-09-02 03:36:52 L1=4.67 run=3 blk=0 avail=6442 (46.8%) swpO=0 conn=8 myRSS=3320 php=4 phpRSS=353 ap=153 tcp=106 topuser=madalice 2026-09-02 03:37:02 L1=4.99 run=7 blk=0 avail=6262 (45.5%) swpO=0 conn=4 myRSS=3320 php=8 phpRSS=757 ap=144 tcp=103 topuser=madalice 2026-09-02 03:37:02 L1=4.99 run=4 blk=0 avail=6239 (45.3%) swpO=0 conn=8 myRSS=3320 php=7 phpRSS=724 ap=144 tcp=97 topuser=madalice 2026-09-02 03:37:12 L1=4.67 run=5 blk=0 avail=6355 (46.1%) swpO=0 conn=4 myRSS=3320 php=7 phpRSS=667 ap=134 tcp=83 topuser=evolution 2026-09-02 03:37:12 L1=4.67 run=4 blk=0 avail=6272 (45.5%) swpO=0 conn=8 myRSS=3320 php=7 phpRSS=741 ap=134 tcp=81 topuser=evolution 2026-09-02 03:37:22 L1=5.18 run=16 blk=0 avail=5611 (40.7%) swpO=0 conn=13 myRSS=3320 php=18 phpRSS=1848 ap=125 tcp=104 topuser=aaa 2026-09-02 03:37:22 L1=5.18 run=17 blk=0 avail=5877 (42.7%) swpO=0 conn=8 myRSS=3320 php=11 phpRSS=1165 ap=125 tcp=115 topuser=evolution 2026-09-02 03:37:33 L1=5.74 run=22 blk=0 avail=5966 (43.3%) swpO=0 conn=14 myRSS=3320 php=19 phpRSS=1661 ap=114 tcp=139 topuser=customc 2026-09-02 03:37:33 L1=5.74 run=27 blk=0 avail=5912 (42.9%) swpO=0 conn=14 myRSS=3320 php=18 phpRSS=1643 ap=114 tcp=170 topuser=customc 2026-09-02 03:37:43 L1=6.37 run=3 blk=0 avail=6861 (49.8%) swpO=623 conn=1 myRSS=3301 php=11 phpRSS=1304 ap=37 tcp=171 topuser=madalice 2026-09-02 03:37:43 L1=6.37 run=1 blk=0 avail=7014 (50.9%) swpO=623 conn=14 myRSS=3301 php=10 phpRSS=1162 ap=37 tcp=167 topuser=madalice 2026-09-02 03:37:53 L1=5.47 run=6 blk=0 avail=6781 (49.2%) swpO=0 conn=1 myRSS=3301 php=11 phpRSS=1409 ap=19 tcp=257 topuser=madalice 2026-09-02 03:37:53 L1=5.47 run=3 blk=0 avail=6715 (48.7%) swpO=0 conn=14 myRSS=3301 php=11 phpRSS=1469 ap=19 tcp=263 topuser=madalice 2026-09-02 03:38:03 L1=6.84 run=11 blk=0 avail=5556 (40.3%) swpO=1 conn=12 myRSS=3301 php=20 phpRSS=2212 ap=110 tcp=223 topuser=madalice 2026-09-02 03:38:03 L1=6.84 run=21 blk=0 avail=5259 (38.2%) swpO=1 conn=16 myRSS=3301 php=23 phpRSS=2616 ap=110 tcp=193 topuser=madalice 2026-09-02 03:38:13 L1=9.53 run=34 blk=0 avail=4307 (31.3%) swpO=37 conn=26 myRSS=3301 php=30 phpRSS=3602 ap=137 tcp=115 topuser=madalice 2026-09-02 03:38:14 L1=9.53 run=35 blk=0 avail=4469 (32.4%) swpO=34 conn=25 myRSS=3301 php=30 phpRSS=3409 ap=139 tcp=123 topuser=madalice 2026-09-02 03:38:24 L1=15.52 run=52 blk=0 avail=3134 (22.8%) swpO=973 conn=39 myRSS=3275 php=44 phpRSS=5030 ap=154 tcp=103 topuser=madalice 2026-09-02 03:38:24 L1=15.52 run=51 blk=0 avail=3163 (23.0%) swpO=1071 conn=38 myRSS=3275 php=43 phpRSS=4879 ap=153 tcp=103 topuser=madalice 2026-09-02 03:38:35 L1=22.10 run=66 blk=0 avail=2968 (21.5%) swpO=0 conn=33 myRSS=3275 php=37 phpRSS=4741 ap=153 tcp=190 topuser=madalice 2026-09-02 03:38:45 L1=24.28 run=53 blk=0 avail=2898 (21.0%) swpO=0 conn=32 myRSS=3275 php=41 phpRSS=4771 ap=153 tcp=130 topuser=madalice 2026-09-02 03:38:47 L1=25.86 run=45 blk=0 avail=3315 (24.1%) swpO=0 conn=33 myRSS=3275 php=37 phpRSS=4399 ap=153 tcp=110 topuser=madalice 2026-09-02 03:38:56 L1=28.03 run=47 blk=0 avail=3541 (25.7%) swpO=0 conn=32 myRSS=3275 php=36 phpRSS=4110 ap=153 tcp=181 topuser=madalice 2026-09-02 03:38:58 L1=29.87 run=41 blk=0 avail=3369 (24.5%) swpO=0 conn=39 myRSS=3275 php=43 phpRSS=4506 ap=153 tcp=204 topuser=madalice 2026-09-02 03:39:06 L1=32.57 run=35 blk=1 avail=4339 (31.5%) swpO=0 conn=29 myRSS=3275 php=30 phpRSS=3356 ap=153 tcp=119 topuser=madalice 2026-09-02 03:39:08 L1=32.57 run=38 blk=0 avail=4059 (29.5%) swpO=0 conn=28 myRSS=3275 php=32 phpRSS=3633 ap=152 tcp=94 topuser=madalice 2026-09-02 03:39:17 L1=33.45 run=41 blk=1 avail=3572 (25.9%) swpO=0 conn=30 myRSS=3275 php=31 phpRSS=3986 ap=153 tcp=92 topuser=madalice 2026-09-02 03:39:19 L1=33.45 run=34 blk=0 avail=3451 (25.0%) swpO=0 conn=30 myRSS=3275 php=35 phpRSS=4241 ap=153 tcp=98 topuser=madalice 2026-09-02 03:39:27 L1=33.62 run=50 blk=0 avail=3661 (26.6%) swpO=0 conn=27 myRSS=3275 php=30 phpRSS=3859 ap=153 tcp=115 topuser=madalice 2026-09-02 03:39:29 L1=33.62 run=38 blk=0 avail=3714 (27.0%) swpO=0 conn=28 myRSS=3275 php=30 phpRSS=3733 ap=153 tcp=112 topuser=madalice