INCIDENT 2026-09-02 03:41:34 trigger: php_rss=1876MB ================================================================== load: 31.03 20.21 9.10 15/737 941865 ncpu:10 mem_avail: 5404MB/13777MB (39.2%) swap_used:2360MB swapout:0/s blocked(D):0 running:20 iowait:0.2% steal:0.0% php: 13 procs / 1876MB heaviest user: madalice (10 procs, 1802MB) apache: 115 procs tcp_estab: 82 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3242 nobody 114 2807 madalice 10 1872 root 250 1105 mailman 20 358 netdata 7 204 cpanellogin 1 143 dovenull 6 64 wp-toolkit 3 59 kurri 3 42 dovecot 3 27 mailnull 3 25 evolution 7 24 zabbix 1 16 lowrange 1 14 aaa 1 14 named 1 12 cpanelconnecttrack 1 4 polkitd 1 3 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1792 root 1 25 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 1694 MB Active(file): 1232 MB Inactive(file): 462 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 451 MB CommitLimit: 10984 MB Committed_AS: 10692 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-01:19:07 2832 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3319852 10.4 Ssl 5-01:22:27 /usr/sbin/mariadbd 918068 3929444 madalice 251820 24.6 S 04:03 php-fpm: pool madalice_com_au 918398 3929444 madalice 215340 25.0 R 03:59 php-fpm: pool madalice_com_au 918948 3929444 madalice 196896 25.6 R 03:36 php-fpm: pool madalice_com_au 706070 655564 root 192020 0.0 S 01:03:37 spamd child 508924 1 netdata 183380 1.9 Ssl 5-01:21:56 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 655564 1 root 174404 0.1 Ss 01:18:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 706071 655564 root 167512 0.0 S 01:03:37 spamd child 918119 3929444 madalice 166512 25.4 R 04:02 php-fpm: pool madalice_com_au 918184 3929444 madalice 165996 22.9 R 04:02 php-fpm: pool madalice_com_au 918434 3929444 madalice 163800 23.4 R 03:58 php-fpm: pool madalice_com_au 918432 3929444 madalice 162416 23.3 R 03:59 php-fpm: pool madalice_com_au 918355 3929444 madalice 161992 22.5 R 04:00 php-fpm: pool madalice_com_au 918981 3929444 madalice 158148 24.7 R 03:35 php-fpm: pool madalice_com_au 916332 3929444 madalice 156676 22.9 R 04:29 php-fpm: pool madalice_com_au 704828 1353308 cpanellogin 146776 0.3 S 01:05:41 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509640 508992 root 77936 0.0 Sl 5-01:21:51 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 41928 0.0 Sl 5-01:21:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3929420 1 wp-toolkit 37352 0.0 Ss 1-01:18:58 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 36988 0.1 Ss 42-01:00:19 cpsrvd (SSL) - waiting for connections 927571 1469 root 33196 0.0 S 01:03 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 33156 0.1 Ss 64-17:31:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 654927 1 root 33144 0.0 Ss 01:18:44 lfd - sleeping 923356 1469 root 33100 0.0 S 02:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 918894 506832 nobody 28100 0.1 S 03:37 /usr/sbin/httpd -k start 918909 506832 nobody 28072 0.0 S 03:37 /usr/sbin/httpd -k start 918913 506832 nobody 28068 0.1 S 03:37 /usr/sbin/httpd -k start 918729 506832 nobody 28036 0.0 S 03:41 /usr/sbin/httpd -k start 918818 506832 nobody 27628 0.1 S 03:38 /usr/sbin/httpd -k start 919305 506832 nobody 27556 0.1 S 03:28 /usr/sbin/httpd -k start 918900 506832 nobody 27540 0.0 S 03:37 /usr/sbin/httpd -k start 918567 506832 nobody 27444 0.0 S 03:50 /usr/sbin/httpd -k start 919202 506832 nobody 27352 0.1 S 03:30 /usr/sbin/httpd -k start 919314 506832 nobody 27336 0.1 S 03:28 /usr/sbin/httpd -k start 918601 506832 nobody 27272 0.1 S 03:47 /usr/sbin/httpd -k start 918840 506832 nobody 27128 0.0 S 03:38 /usr/sbin/httpd -k start 918775 506832 nobody 27096 0.1 S 03:39 /usr/sbin/httpd -k start 918827 506832 nobody 27080 0.0 S 03:38 /usr/sbin/httpd -k start 919320 506832 nobody 27028 0.0 S 03:28 /usr/sbin/httpd -k start 918821 506832 nobody 27016 0.0 S 03:38 /usr/sbin/httpd -k start 918911 506832 nobody 26988 0.1 S 03:37 /usr/sbin/httpd -k start 918914 506832 nobody 26980 0.0 S 03:37 /usr/sbin/httpd -k start 919204 506832 nobody 26964 0.1 S 03:30 /usr/sbin/httpd -k start 918784 506832 nobody 26936 0.0 S 03:39 /usr/sbin/httpd -k start 918652 506832 nobody 26928 0.1 S 03:44 /usr/sbin/httpd -k start 918782 506832 nobody 26900 0.1 S 03:39 /usr/sbin/httpd -k start 918910 506832 nobody 26900 0.1 S 03:37 /usr/sbin/httpd -k start 918560 506832 nobody 26896 0.0 S 03:51 /usr/sbin/httpd -k start 918744 506832 nobody 26896 0.0 S 03:40 /usr/sbin/httpd -k start 918720 506832 nobody 26892 0.0 S 03:42 /usr/sbin/httpd -k start 918820 506832 nobody 26880 0.0 S 03:38 /usr/sbin/httpd -k start 919313 506832 nobody 26832 0.1 S 03:28 /usr/sbin/httpd -k start 919250 506832 nobody 26788 0.1 S 03:29 /usr/sbin/httpd -k start 918897 506832 nobody 26748 0.0 S 03:37 /usr/sbin/httpd -k start 918823 506832 nobody 26716 0.0 S 03:38 /usr/sbin/httpd -k start 918916 506832 nobody 26612 0.1 S 03:37 /usr/sbin/httpd -k start 919317 506832 nobody 26504 0.0 S 03:28 /usr/sbin/httpd -k start 918893 506832 nobody 26444 0.0 S 03:37 /usr/sbin/httpd -k start 918721 506832 nobody 26420 0.0 S 03:42 /usr/sbin/httpd -k start 918839 506832 nobody 26368 0.1 S 03:38 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15554287 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 15554260 | madalice_wp | madalice_wp | Query | 0 | Statistics | SELECT meta_value FROM AMuqf6qZ_postmeta WHERE meta_key = 'attribute_brand' AND post_id IN (34498,34499,34500,34501,34502,34503,34504,34505,34506,34474,34476,34478,34480,34482,34484,34486,34488,34490,34492,34493,34494,34495,34496,34497,34470,34471,34472) | +----------+-------------+-------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 520 otterfencing/otterfencing.com.au-ssl_log 300 tubesupplies/tubesupplies.com.au-ssl_log 298 cosgrovecreative/cosgrovecreative.com.au-ssl_log 277 otterfencing/otterfencing.com.au 258 evolution/evolutionerp.com.au-ssl_log 248 aaa/aaadownunder.com.au-ssl_log 210 speedlin/speedlinefencing.com.au-ssl_log 144 otter2/otterfencing.net.au-ssl_log 137 candyfabcom/candyfab.com.au-ssl_log 134 lowrange/lowrange.com.au-ssl_log 126 customc/customcentral.com.au-ssl_log 102 infinium/infinium.net.au-ssl_log 102 coscom/coscom.com.au-ssl_log 96 evolution/app.evolutionerp.com.au-ssl_log 96 (total vhosts taking traffic: 24) --- top client IPs across all vhosts (last 3 min) --- 646 158.69.55.148 563 158.69.55.82 510 158.69.117.45 250 130.12.180.117 100 158.23.18.78 96 40.115.94.245 67 206.81.24.227 61 130.12.182.254 59 206.189.95.232 58 164.92.107.174 56 209.38.248.17 55 134.209.25.199 50 165.22.235.3 41 164.92.244.132 40 207.154.212.47 --- top request paths across all vhosts (last 3 min) --- 1651 GET / 90 GET /cgi-bin/ 65 GET /api/getItem/LWHG2001KG 58 GET /.env 47 OPTIONS / 47 GET /@vite/env 45 GET /debug/default/view 43 GET /actuator/env 42 GET /trace.axd 41 GET /.well-known/security.txt 40 GET /telescope/requests 40 GET /info.php 37 POST /graphql/api 37 POST /api/gql 36 GET /s/5353e20343e2732313e2831313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 35 POST /api/graphql 34 POST /api 33 GET /.git/HEAD 32 POST /graphql 32 GET /.git/config --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 252 GET / 10 GET /.git/HEAD 10 GET /.env 9 POST / 9 GET /debug/default/view 8 OPTIONS / 7 POST /wp-json/batch/v1 7 GET /@vite/env 6 GET /store/airmax-90-sneakers/ 6 GET /resetpass 4 GET /trace.axd 4 GET /actuator/env -- last 10 requests -- 158.69.117.45 - - [02/Sep/2026:03:41:09 +1000] "GET /store/pearl-and-crystal-nike-swoosh-af1/ HTTP/1.1" 200 56284 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Saf 158.69.117.45 - - [02/Sep/2026:03:41:09 +1000] "GET /store/hand-painted-nike-bandana/ HTTP/1.1" 200 55117 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537. 158.69.55.82 - - [02/Sep/2026:03:41:09 +1000] "GET /store/hand-dyed-crew-socks-multi-colour-essentials-pack-3-6-pairs/ HTTP/1.1" 200 55902 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 158.69.55.82 - - [02/Sep/2026:03:41:10 +1000] "GET /store/hand-dyed-nike-crew-socks-gift-pack-yellow-sunshine-edition/ HTTP/1.1" 200 53581 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 158.69.55.82 - - [02/Sep/2026:03:41:10 +1000] "GET /store/hand-dyed-nike-crew-socks-gift-pack-green-frog-edition/ HTTP/1.1" 200 54093 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 114.119.146.16 - - [02/Sep/2026:03:41:12 +1000] "GET /store/airmax-90-sneakers/?rating=4&wcpr_page=4&wcpr_verified=1&wcpr_image=1 HTTP/1.1" 200 50110 "https://madalice.com.au/store/airmax-90-sneakers/?rating=4&wcpr_page= 158.69.117.45 - - [02/Sep/2026:03:41:14 +1000] "GET /store/custom-name-or-number-shoes/ HTTP/1.1" 200 53749 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/53 158.69.117.45 - - [02/Sep/2026:03:41:15 +1000] "GET /product-category/accessories/page/2/ HTTP/1.1" 200 40209 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/ 158.69.117.45 - - [02/Sep/2026:03:41:14 +1000] "GET /store/antique-silver-padlock-sneaker-dubraes/ HTTP/1.1" 200 50272 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0. 158.69.55.82 - - [02/Sep/2026:03:41:16 +1000] "GET /store/hand-dyed-nike-crew-socks-pink-hues-gift-pack/ HTTP/1.1" 200 55116 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 63 GET / 10 POST /graphql/api 10 POST /graphql 10 POST /api/graphql 10 POST /api/gql 10 POST /api 10 OPTIONS / 10 GET /.well-known/security.txt 10 GET /@vite/env 10 GET /trace.axd 10 GET /telescope/requests 10 GET /s/5353e20343e2732313e2831313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties -- last 10 requests -- 130.12.180.117 - - [02/Sep/2026:03:40:24 +1000] "GET /.env.prod HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security htt 138.68.82.23 - - [02/Sep/2026:03:40:14 +1000] "GET /trace.axd HTTP/1.1" 404 15384 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 130.12.180.117 - - [02/Sep/2026:03:40:25 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Securit 130.12.180.117 - - [02/Sep/2026:03:40:12 +1000] "GET /.env.bak HTTP/1.1" 301 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https 130.12.180.117 - - [02/Sep/2026:03:40:26 +1000] "GET /.env.staging HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security 138.68.82.23 - - [02/Sep/2026:03:40:17 +1000] "GET /@vite/env HTTP/1.1" 404 15384 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 138.68.82.23 - - [02/Sep/2026:03:40:22 +1000] "OPTIONS / HTTP/1.1" 200 15343 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 130.12.180.117 - - [02/Sep/2026:03:40:29 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security ht 130.12.180.117 - - [02/Sep/2026:03:40:30 +1000] "GET /.env.live HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security htt 138.68.82.23 - - [02/Sep/2026:03:40:26 +1000] "POST /?rest_route=/batch/v1 HTTP/1.1" 500 1502 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 38 GET / 10 POST /graphql/api 10 POST /graphql 10 POST /api/gql 10 POST /api 10 GET /.well-known/security.txt 10 GET /@vite/env 10 GET /v2/_catalog 10 GET /trace.axd 10 GET /telescope/requests 10 GET /server-status 10 GET /server -- last 10 requests -- 157.245.36.108 - - [02/Sep/2026:03:40:53 +1000] "GET /trace.axd HTTP/1.1" 404 15751 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.71.175.236 - - [02/Sep/2026:03:40:52 +1000] "OPTIONS / HTTP/1.1" 200 15714 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 157.245.36.108 - - [02/Sep/2026:03:40:55 +1000] "GET /@vite/env HTTP/1.1" 404 15751 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 157.230.19.140 - - [02/Sep/2026:03:40:53 +1000] "GET /actuator/env HTTP/1.1" 404 15751 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.71.175.236 - - [02/Sep/2026:03:40:56 +1000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 628 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.71.175.236 - - [02/Sep/2026:03:40:59 +1000] "POST /wp-json/batch/v1 HTTP/1.1" 207 628 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 157.245.36.108 - - [02/Sep/2026:03:40:59 +1000] "OPTIONS / HTTP/1.1" 200 15714 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 157.230.19.140 - - [02/Sep/2026:03:40:56 +1000] "GET /trace.axd HTTP/1.1" 404 15751 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 157.230.19.140 - - [02/Sep/2026:03:40:59 +1000] "GET /@vite/env HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 157.245.36.108 - - [02/Sep/2026:03:41:03 +1000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 628 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" --- last 30 samples (run-up to this incident) --- 2026-09-02 03:38:58 L1=29.87 run=41 blk=0 avail=3369 (24.5%) swpO=0 conn=39 myRSS=3275 php=43 phpRSS=4506 ap=153 tcp=204 topuser=madalice 2026-09-02 03:39:06 L1=32.57 run=35 blk=1 avail=4339 (31.5%) swpO=0 conn=29 myRSS=3275 php=30 phpRSS=3356 ap=153 tcp=119 topuser=madalice 2026-09-02 03:39:08 L1=32.57 run=38 blk=0 avail=4059 (29.5%) swpO=0 conn=28 myRSS=3275 php=32 phpRSS=3633 ap=152 tcp=94 topuser=madalice 2026-09-02 03:39:17 L1=33.45 run=41 blk=1 avail=3572 (25.9%) swpO=0 conn=30 myRSS=3275 php=31 phpRSS=3986 ap=153 tcp=92 topuser=madalice 2026-09-02 03:39:19 L1=33.45 run=34 blk=0 avail=3451 (25.0%) swpO=0 conn=30 myRSS=3275 php=35 phpRSS=4241 ap=153 tcp=98 topuser=madalice 2026-09-02 03:39:27 L1=33.62 run=50 blk=0 avail=3661 (26.6%) swpO=0 conn=27 myRSS=3275 php=30 phpRSS=3859 ap=153 tcp=115 topuser=madalice 2026-09-02 03:39:29 L1=33.62 run=38 blk=0 avail=3714 (27.0%) swpO=0 conn=28 myRSS=3275 php=30 phpRSS=3733 ap=153 tcp=112 topuser=madalice 2026-09-02 03:39:40 L1=34.05 run=58 blk=0 avail=2892 (21.0%) swpO=0 conn=39 myRSS=3275 php=45 phpRSS=5056 ap=152 tcp=115 topuser=madalice 2026-09-02 03:39:48 L1=36.49 run=60 blk=0 avail=3120 (22.6%) swpO=0 conn=37 myRSS=3275 php=43 phpRSS=4669 ap=147 tcp=85 topuser=madalice 2026-09-02 03:39:50 L1=36.49 run=46 blk=0 avail=3050 (22.1%) swpO=0 conn=35 myRSS=3275 php=40 phpRSS=4640 ap=144 tcp=96 topuser=madalice 2026-09-02 03:39:58 L1=37.43 run=59 blk=0 avail=2827 (20.5%) swpO=0 conn=39 myRSS=3275 php=44 phpRSS=5115 ap=144 tcp=170 topuser=madalice 2026-09-02 03:40:01 L1=37.43 run=53 blk=0 avail=2726 (19.8%) swpO=0 conn=36 myRSS=3274 php=41 phpRSS=5019 ap=153 tcp=186 topuser=madalice 2026-09-02 03:40:09 L1=37.87 run=66 blk=1 avail=2337 (17.0%) swpO=0 conn=46 myRSS=3273 php=51 phpRSS=5749 ap=151 tcp=92 topuser=madalice 2026-09-02 03:40:11 L1=39.64 run=61 blk=3 avail=2159 (15.7%) swpO=722 conn=47 myRSS=3254 php=54 phpRSS=5936 ap=149 tcp=89 topuser=otterfencing 2026-09-02 03:40:20 L1=40.95 run=54 blk=0 avail=2465 (17.9%) swpO=1116 conn=42 myRSS=3240 php=47 phpRSS=5369 ap=141 tcp=122 topuser=otterfencing 2026-09-02 03:40:22 L1=42.16 run=51 blk=1 avail=2712 (19.7%) swpO=459 conn=38 myRSS=3240 php=44 phpRSS=5243 ap=139 tcp=84 topuser=madalice 2026-09-02 03:40:30 L1=41.26 run=27 blk=0 avail=4444 (32.3%) swpO=0 conn=17 myRSS=3240 php=22 phpRSS=2906 ap=131 tcp=63 topuser=madalice 2026-09-02 03:40:32 L1=39.16 run=16 blk=0 avail=4672 (33.9%) swpO=0 conn=11 myRSS=3240 php=21 phpRSS=2588 ap=129 tcp=45 topuser=madalice 2026-09-02 03:40:42 L1=34.45 run=24 blk=0 avail=4767 (34.6%) swpO=2 conn=12 myRSS=3240 php=20 phpRSS=2628 ap=119 tcp=119 topuser=madalice 2026-09-02 03:40:43 L1=34.45 run=18 blk=0 avail=5148 (37.4%) swpO=1 conn=12 myRSS=3240 php=18 phpRSS=2210 ap=118 tcp=149 topuser=madalice 2026-09-02 03:40:53 L1=31.87 run=49 blk=0 avail=3667 (26.6%) swpO=0 conn=32 myRSS=3240 php=38 phpRSS=4167 ap=146 tcp=174 topuser=madalice 2026-09-02 03:40:53 L1=31.87 run=60 blk=0 avail=3410 (24.8%) swpO=0 conn=35 myRSS=3240 php=39 phpRSS=4464 ap=146 tcp=172 topuser=madalice 2026-09-02 03:41:03 L1=34.59 run=49 blk=0 avail=2782 (20.2%) swpO=0 conn=40 myRSS=3241 php=46 phpRSS=5264 ap=139 tcp=128 topuser=madalice 2026-09-02 03:41:04 L1=34.59 run=54 blk=2 avail=3196 (23.2%) swpO=0 conn=41 myRSS=3241 php=46 phpRSS=4830 ap=139 tcp=129 topuser=madalice 2026-09-02 03:41:14 L1=35.71 run=39 blk=0 avail=3900 (28.3%) swpO=0 conn=34 myRSS=3242 php=37 phpRSS=4048 ap=132 tcp=115 topuser=madalice 2026-09-02 03:41:14 L1=35.71 run=40 blk=0 avail=3864 (28.0%) swpO=0 conn=35 myRSS=3242 php=36 phpRSS=4068 ap=132 tcp=116 topuser=madalice 2026-09-02 03:41:24 L1=34.37 run=30 blk=1 avail=4532 (32.9%) swpO=0 conn=21 myRSS=3242 php=23 phpRSS=3058 ap=122 tcp=128 topuser=madalice 2026-09-02 03:41:25 L1=34.37 run=22 blk=0 avail=4553 (33.0%) swpO=0 conn=22 myRSS=3242 php=24 phpRSS=3114 ap=122 tcp=128 topuser=madalice 2026-09-02 03:41:34 L1=31.03 run=20 blk=0 avail=5404 (39.2%) swpO=0 conn=11 myRSS=3242 php=13 phpRSS=1876 ap=115 tcp=82 topuser=madalice 2026-09-02 03:41:35 L1=31.03 run=18 blk=0 avail=5478 (39.8%) swpO=0 conn=14 myRSS=3242 php=15 phpRSS=1976 ap=114 tcp=89 topuser=madalice