INCIDENT 2026-09-02 03:40:30 trigger: php_rss=2906MB mysql_conn=17 ================================================================== load: 41.26 18.94 7.92 21/778 927312 ncpu:10 mem_avail: 4444MB/13777MB (32.3%) swap_used:2361MB swapout:0/s blocked(D):0 running:27 iowait:1.8% steal:0.0% php: 22 procs / 2906MB heaviest user: madalice (10 procs, 1791MB) apache: 131 procs tcp_estab: 63 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3240 nobody 130 3081 madalice 10 1675 root 264 1247 otterfencing 3 378 tubesupplies 4 373 mailman 20 358 netdata 7 204 olympic 1 125 infinium 1 124 cpanellogin 1 119 wp-toolkit 3 91 dovenull 6 65 alison 1 59 kurri 3 42 evolution 9 30 dovecot 3 27 mailnull 2 17 zabbix 1 16 lowrange 1 14 --- php workers by user --- USER PROCS RSS_MB madalice 10 1679 otterfencing 3 383 tubesupplies 4 377 olympic 1 125 infinium 1 124 alison 1 62 root 1 26 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2119 MB Active(file): 1086 MB Inactive(file): 543 MB Dirty: 6 MB Writeback: 0 MB SReclaimable: 453 MB CommitLimit: 10984 MB Committed_AS: 12573 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 924981 root 00:30 1256 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 1-01:18:03 2832 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3318252 10.4 Ssl 5-01:21:23 /usr/sbin/mariadbd 706070 655564 root 192044 0.0 S 01:02:33 spamd child 918119 3929444 madalice 189416 22.0 S 02:58 php-fpm: pool madalice_com_au 918432 3929444 madalice 184648 21.4 R 02:55 php-fpm: pool madalice_com_au 508924 1 netdata 184124 1.9 Ssl 5-01:20:52 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 916332 3929444 madalice 176620 21.4 R 03:25 php-fpm: pool madalice_com_au 655564 1 root 174404 0.1 Ss 01:17:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 706071 655564 root 167512 0.0 S 01:02:33 spamd child 918398 3929444 madalice 167088 23.1 R 02:55 php-fpm: pool madalice_com_au 918068 3929444 madalice 164708 22.0 R 02:59 php-fpm: pool madalice_com_au 918355 3929444 madalice 161844 21.2 S 02:56 php-fpm: pool madalice_com_au 918434 3929444 madalice 160708 22.5 S 02:54 php-fpm: pool madalice_com_au 918948 3929444 madalice 158984 23.0 S 02:32 php-fpm: pool madalice_com_au 918981 3929444 madalice 158832 22.3 S 02:31 php-fpm: pool madalice_com_au 918184 3929444 madalice 158828 21.7 S 02:58 php-fpm: pool madalice_com_au 926914 918901 tubesupplies 150064 50.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 926815 919662 otterfencing 141572 39.2 R 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 926999 919204 tubesupplies 139244 58.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 926117 918909 olympic 130736 15.6 R 00:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 704828 1353308 cpanellogin 123120 0.3 S 01:04:37 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 927080 924871 otterfencing 121628 61.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 927093 918743 tubesupplies 87984 54.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 927239 918783 alison 81324 67.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 77936 0.0 Sl 5-01:20:47 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 927334 919318 otterfencing 65752 24.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 927272 919787 tubesupplies 65640 46.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 41928 0.0 Sl 5-01:20:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 927376 918917 tubesupplies 41108 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3929420 1 wp-toolkit 37352 0.0 Ss 1-01:17:54 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 36944 0.1 Ss 42-00:59:15 cpsrvd (SSL) - waiting for connections 924521 3929469 wp-toolkit 35388 0.0 S 00:43 sw-engine-fpm: pool wordpress-toolkit 927384 1353308 root 33928 0.0 S 00:00 cpaneld - serving 127.0.0.1 927385 1353308 root 33928 0.0 S 00:00 cpaneld - serving 127.0.0.1 927383 1353308 root 33912 0.0 S 00:00 cpaneld - serving 127.0.0.1 1469 1 root 33156 0.1 Ss 64-17:30:44 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 923356 1469 root 33100 0.0 S 01:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 924036 1469 root 33100 0.0 S 00:57 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 654927 1 root 33088 0.0 Ss 01:17:40 lfd - sleeping 921922 1469 root 32864 0.0 S 01:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 27480 0.0 Ss 1-01:17:54 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 918731 506832 nobody 27056 0.1 S 02:37 /usr/sbin/httpd -k start 918909 506832 nobody 26776 0.0 S 02:33 /usr/sbin/httpd -k start 919126 506832 nobody 26384 0.0 S 02:28 /usr/sbin/httpd -k start 918900 506832 nobody 26348 0.0 S 02:33 /usr/sbin/httpd -k start 918489 506832 nobody 26324 0.1 S 02:50 /usr/sbin/httpd -k start 918906 506832 nobody 26184 0.0 S 02:33 /usr/sbin/httpd -k start 918911 506832 nobody 26048 0.1 S 02:33 /usr/sbin/httpd -k start 918652 506832 nobody 26036 0.0 S 02:40 /usr/sbin/httpd -k start 919248 506832 nobody 26016 0.0 S 02:25 /usr/sbin/httpd -k start 918661 506832 nobody 26008 0.0 S 02:39 /usr/sbin/httpd -k start 918729 506832 nobody 25996 0.0 S 02:37 /usr/sbin/httpd -k start 918894 506832 nobody 25988 0.1 S 02:33 /usr/sbin/httpd -k start 918775 506832 nobody 25976 0.2 S 02:35 /usr/sbin/httpd -k start 918747 506832 nobody 25948 0.0 S 02:36 /usr/sbin/httpd -k start 919305 506832 nobody 25924 0.1 S 02:24 /usr/sbin/httpd -k start 919661 506832 nobody 25836 0.0 S 02:15 /usr/sbin/httpd -k start 918914 506832 nobody 25832 0.0 S 02:33 /usr/sbin/httpd -k start 918560 506832 nobody 25816 0.0 S 02:47 /usr/sbin/httpd -k start 918784 506832 nobody 25816 0.0 S 02:35 /usr/sbin/httpd -k start 918827 506832 nobody 25772 0.1 S 02:34 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 926117 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15553466 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 574 aaa/aaadownunder.com.au-ssl_log 517 otterfencing/otterfencing.com.au-ssl_log 485 cosgrovecreative/cosgrovecreative.com.au-ssl_log 296 otterfencing/otterfencing.com.au 291 tubesupplies/tubesupplies.com.au-ssl_log 284 speedlin/speedlinefencing.com.au-ssl_log 264 evolution/evolutionerp.com.au-ssl_log 209 alison/alisonarts.com.au-ssl_log 194 kurri/kurrimotorinn.com.au-ssl_log 167 nrg/nrgservices.net.au-ssl_log 159 infinium/infinium.net.au-ssl_log 141 lowrange/lowrange.com.au-ssl_log 136 coscom/coscom.com.au-ssl_log 114 otter2/otterfencing.net.au-ssl_log 97 (total vhosts taking traffic: 31) --- top client IPs across all vhosts (last 3 min) --- 539 158.69.55.82 507 158.69.55.148 412 158.69.117.45 215 130.12.180.117 167 206.81.24.227 133 165.22.235.3 113 157.245.36.108 112 165.22.34.189 109 130.12.182.254 108 139.59.143.102 107 64.226.65.160 107 159.223.132.86 102 207.154.212.47 100 209.38.248.17 100 158.23.18.78 --- top request paths across all vhosts (last 3 min) --- 2110 GET / 127 GET /.env 82 GET /cgi-bin/ 81 GET /.git/config 79 POST /graphql 78 POST /api 77 POST /api/graphql 77 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 76 POST /api/gql 74 POST /graphql/api 74 GET /telescope/requests 73 GET /info.php 73 GET /actuator/env 71 GET /trace.axd 70 GET /.well-known/security.txt 70 GET /v2/_catalog 69 GET /@vite/env 68 GET /___proxy_subdomain_whm/login 67 GET /.DS_Store 64 OPTIONS / --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 54 GET / 27 GET /.env 17 POST /graphql 17 POST /api/graphql 17 POST /api/gql 17 POST /api 17 OPTIONS / 17 GET /.well-known/security.txt 17 GET /@vite/env 17 GET /v2/_catalog 17 GET /trace.axd 17 GET /telescope/requests -- last 10 requests -- 130.12.182.254 - - [02/Sep/2026:03:39:49 +1000] "GET /.git/HEAD HTTP/1.1" 301 - "-" "Go-http-client/1.1" 130.12.182.254 - - [02/Sep/2026:03:39:59 +1000] "GET /.git/HEAD HTTP/1.1" 301 1 "-" "Go-http-client/2.0" 17.166.152.90 - - [02/Sep/2026:03:40:03 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/product-category/socks/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit 114.119.146.16 - - [02/Sep/2026:03:39:42 +1000] "GET /store/airmax-90-sneakers/?rating=5&wcpr_image=1&wcpr_rating=4 HTTP/1.1" 200 50268 "https://madalice.com.au/store/airmax-90-sneakers/?rating=5&wcpr_image=1&wcpr_rating 209.38.248.17 - - [02/Sep/2026:03:39:35 +1000] "GET /debug/default/view?panel=config HTTP/1.1" 404 36637 "-" "Mozilla/5.0 (l9scan/2.0.438313e223e26323e2430313; +https://leakix.net)" 2a03:2880:f802:12:: - - [02/Sep/2026:03:39:50 +1000] "GET /mep_cat/sneakerlab-custom/ HTTP/1.1" 200 34769 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537. 130.12.182.254 - - [02/Sep/2026:03:39:59 +1000] "GET /.git/HEAD HTTP/1.1" 404 36615 "-" "Go-http-client/2.0" 159.89.12.166 - - [02/Sep/2026:03:39:36 +1000] "GET /debug/default/view?panel=config HTTP/1.1" 404 36638 "-" "Mozilla/5.0 (l9scan/2.0.438313e233e26323e2430313; +https://leakix.net)" 17.166.152.90 - - [02/Sep/2026:03:40:17 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/product-category/socks/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit 17.166.151.51 - - [02/Sep/2026:03:40:04 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 601 "https://madalice.com.au/product-category/socks/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605. == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 469 GET / 2 POST /wp-login.php 2 POST /wp-cron.php 1 GET /wp-login.php 1 GET /resetpass 1 GET /index.php/2019/11/11/nords-wharf-piers/ -- last 10 requests -- 158.69.55.148 - - [02/Sep/2026:03:40:20 +1000] "GET /?locale=hu HTTP/1.1" 200 12723 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:40:21 +1000] "GET /?locale=pt HTTP/1.1" 401 12526 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:40:21 +1000] "GET /?locale=ru HTTP/1.1" 401 12990 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:40:22 +1000] "GET /?locale=ro HTTP/1.1" 401 12656 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 118.127.40.55 - - [02/Sep/2026:03:40:15 +1000] "POST /wp-cron.php?doing_wp_cron=1788284415.5665268898010253906250 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://aaadownunder.com.au" 158.69.55.148 - - [02/Sep/2026:03:40:22 +1000] "GET /?locale=th HTTP/1.1" 200 12880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:40:22 +1000] "GET /resetpass?start=1 HTTP/1.1" 200 1110 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:40:22 +1000] "GET /?locale=zh HTTP/1.1" 200 12816 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:40:22 +1000] "GET /?locale=ru HTTP/1.1" 200 12968 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.55.148 - - [02/Sep/2026:03:40:22 +1000] "GET /?locale=ro HTTP/1.1" 401 12667 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 173 GET / 12 GET /.env 10 POST /graphql/api 10 POST /graphql 10 POST /api/graphql 10 POST /api/gql 10 POST /api 10 OPTIONS / 10 GET /.well-known/security.txt 10 GET /@vite/env 10 GET /trace.axd 10 GET /telescope/requests -- last 10 requests -- 130.12.180.117 - - [02/Sep/2026:03:40:24 +1000] "GET /.env.prod HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security htt 138.68.82.23 - - [02/Sep/2026:03:40:14 +1000] "GET /trace.axd HTTP/1.1" 404 15384 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 130.12.180.117 - - [02/Sep/2026:03:40:25 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Securit 130.12.180.117 - - [02/Sep/2026:03:40:12 +1000] "GET /.env.bak HTTP/1.1" 301 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https 130.12.180.117 - - [02/Sep/2026:03:40:26 +1000] "GET /.env.staging HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security 138.68.82.23 - - [02/Sep/2026:03:40:17 +1000] "GET /@vite/env HTTP/1.1" 404 15384 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 138.68.82.23 - - [02/Sep/2026:03:40:22 +1000] "OPTIONS / HTTP/1.1" 200 15343 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 130.12.180.117 - - [02/Sep/2026:03:40:29 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security ht 130.12.180.117 - - [02/Sep/2026:03:40:30 +1000] "GET /.env.live HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security htt 138.68.82.23 - - [02/Sep/2026:03:40:26 +1000] "POST /?rest_route=/batch/v1 HTTP/1.1" 500 1502 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" --- last 30 samples (run-up to this incident) --- 2026-09-02 03:37:53 L1=5.47 run=6 blk=0 avail=6781 (49.2%) swpO=0 conn=1 myRSS=3301 php=11 phpRSS=1409 ap=19 tcp=257 topuser=madalice 2026-09-02 03:37:53 L1=5.47 run=3 blk=0 avail=6715 (48.7%) swpO=0 conn=14 myRSS=3301 php=11 phpRSS=1469 ap=19 tcp=263 topuser=madalice 2026-09-02 03:38:03 L1=6.84 run=11 blk=0 avail=5556 (40.3%) swpO=1 conn=12 myRSS=3301 php=20 phpRSS=2212 ap=110 tcp=223 topuser=madalice 2026-09-02 03:38:03 L1=6.84 run=21 blk=0 avail=5259 (38.2%) swpO=1 conn=16 myRSS=3301 php=23 phpRSS=2616 ap=110 tcp=193 topuser=madalice 2026-09-02 03:38:13 L1=9.53 run=34 blk=0 avail=4307 (31.3%) swpO=37 conn=26 myRSS=3301 php=30 phpRSS=3602 ap=137 tcp=115 topuser=madalice 2026-09-02 03:38:14 L1=9.53 run=35 blk=0 avail=4469 (32.4%) swpO=34 conn=25 myRSS=3301 php=30 phpRSS=3409 ap=139 tcp=123 topuser=madalice 2026-09-02 03:38:24 L1=15.52 run=52 blk=0 avail=3134 (22.8%) swpO=973 conn=39 myRSS=3275 php=44 phpRSS=5030 ap=154 tcp=103 topuser=madalice 2026-09-02 03:38:24 L1=15.52 run=51 blk=0 avail=3163 (23.0%) swpO=1071 conn=38 myRSS=3275 php=43 phpRSS=4879 ap=153 tcp=103 topuser=madalice 2026-09-02 03:38:35 L1=22.10 run=66 blk=0 avail=2968 (21.5%) swpO=0 conn=33 myRSS=3275 php=37 phpRSS=4741 ap=153 tcp=190 topuser=madalice 2026-09-02 03:38:45 L1=24.28 run=53 blk=0 avail=2898 (21.0%) swpO=0 conn=32 myRSS=3275 php=41 phpRSS=4771 ap=153 tcp=130 topuser=madalice 2026-09-02 03:38:47 L1=25.86 run=45 blk=0 avail=3315 (24.1%) swpO=0 conn=33 myRSS=3275 php=37 phpRSS=4399 ap=153 tcp=110 topuser=madalice 2026-09-02 03:38:56 L1=28.03 run=47 blk=0 avail=3541 (25.7%) swpO=0 conn=32 myRSS=3275 php=36 phpRSS=4110 ap=153 tcp=181 topuser=madalice 2026-09-02 03:38:58 L1=29.87 run=41 blk=0 avail=3369 (24.5%) swpO=0 conn=39 myRSS=3275 php=43 phpRSS=4506 ap=153 tcp=204 topuser=madalice 2026-09-02 03:39:06 L1=32.57 run=35 blk=1 avail=4339 (31.5%) swpO=0 conn=29 myRSS=3275 php=30 phpRSS=3356 ap=153 tcp=119 topuser=madalice 2026-09-02 03:39:08 L1=32.57 run=38 blk=0 avail=4059 (29.5%) swpO=0 conn=28 myRSS=3275 php=32 phpRSS=3633 ap=152 tcp=94 topuser=madalice 2026-09-02 03:39:17 L1=33.45 run=41 blk=1 avail=3572 (25.9%) swpO=0 conn=30 myRSS=3275 php=31 phpRSS=3986 ap=153 tcp=92 topuser=madalice 2026-09-02 03:39:19 L1=33.45 run=34 blk=0 avail=3451 (25.0%) swpO=0 conn=30 myRSS=3275 php=35 phpRSS=4241 ap=153 tcp=98 topuser=madalice 2026-09-02 03:39:27 L1=33.62 run=50 blk=0 avail=3661 (26.6%) swpO=0 conn=27 myRSS=3275 php=30 phpRSS=3859 ap=153 tcp=115 topuser=madalice 2026-09-02 03:39:29 L1=33.62 run=38 blk=0 avail=3714 (27.0%) swpO=0 conn=28 myRSS=3275 php=30 phpRSS=3733 ap=153 tcp=112 topuser=madalice 2026-09-02 03:39:40 L1=34.05 run=58 blk=0 avail=2892 (21.0%) swpO=0 conn=39 myRSS=3275 php=45 phpRSS=5056 ap=152 tcp=115 topuser=madalice 2026-09-02 03:39:48 L1=36.49 run=60 blk=0 avail=3120 (22.6%) swpO=0 conn=37 myRSS=3275 php=43 phpRSS=4669 ap=147 tcp=85 topuser=madalice 2026-09-02 03:39:50 L1=36.49 run=46 blk=0 avail=3050 (22.1%) swpO=0 conn=35 myRSS=3275 php=40 phpRSS=4640 ap=144 tcp=96 topuser=madalice 2026-09-02 03:39:58 L1=37.43 run=59 blk=0 avail=2827 (20.5%) swpO=0 conn=39 myRSS=3275 php=44 phpRSS=5115 ap=144 tcp=170 topuser=madalice 2026-09-02 03:40:01 L1=37.43 run=53 blk=0 avail=2726 (19.8%) swpO=0 conn=36 myRSS=3274 php=41 phpRSS=5019 ap=153 tcp=186 topuser=madalice 2026-09-02 03:40:09 L1=37.87 run=66 blk=1 avail=2337 (17.0%) swpO=0 conn=46 myRSS=3273 php=51 phpRSS=5749 ap=151 tcp=92 topuser=madalice 2026-09-02 03:40:11 L1=39.64 run=61 blk=3 avail=2159 (15.7%) swpO=722 conn=47 myRSS=3254 php=54 phpRSS=5936 ap=149 tcp=89 topuser=otterfencing 2026-09-02 03:40:20 L1=40.95 run=54 blk=0 avail=2465 (17.9%) swpO=1116 conn=42 myRSS=3240 php=47 phpRSS=5369 ap=141 tcp=122 topuser=otterfencing 2026-09-02 03:40:22 L1=42.16 run=51 blk=1 avail=2712 (19.7%) swpO=459 conn=38 myRSS=3240 php=44 phpRSS=5243 ap=139 tcp=84 topuser=madalice 2026-09-02 03:40:30 L1=41.26 run=27 blk=0 avail=4444 (32.3%) swpO=0 conn=17 myRSS=3240 php=22 phpRSS=2906 ap=131 tcp=63 topuser=madalice 2026-09-02 03:40:32 L1=39.16 run=16 blk=0 avail=4672 (33.9%) swpO=0 conn=11 myRSS=3240 php=21 phpRSS=2588 ap=129 tcp=45 topuser=madalice