INCIDENT 2026-09-03 02:38:02 trigger: php_procs=32 php_rss=3202MB mysql_conn=28 ================================================================== load: 0.72 0.80 1.00 34/825 1596505 ncpu:10 mem_avail: 6567MB/13777MB (47.7%) swap_used:1554MB swapout:1470/s blocked(D):0 running:37 iowait:0.1% steal:0.0% php: 32 procs / 3202MB heaviest user: speedlin (27 procs, 2763MB) apache: 140 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB speedlin 27 2766 mysql 1 2122 nobody 139 2109 root 247 1032 madalice 2 313 netdata 8 306 wp-toolkit 2 127 evolution 9 102 kurri 3 27 mailman 20 26 dovenull 6 26 lowrange 2 24 infinium 2 23 polkitd 1 22 cpanellogin 1 18 mailnull 3 16 zabbix 1 14 cpanelphpmyadmin 1 14 aaa 1 13 vinesit 1 12 --- php workers by user --- USER PROCS RSS_MB speedlin 26 2793 madalice 2 313 evolution 2 101 root 1 36 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6879 MB Active(file): 3598 MB Inactive(file): 2394 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 610 MB CommitLimit: 10984 MB Committed_AS: 13633 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 2-00:15:34 5216 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 2169936 8.8 Ssl 12:23:49 /usr/sbin/mariadbd 1543747 1 root 175084 0.4 Ss 15:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1542443 1 netdata 169356 2.7 Ssl 15:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1596047 1543747 root 169288 0.5 S 00:14 spamd child 1596048 1543747 root 167752 0.0 S 00:14 spamd child 1595990 1542510 madalice 160712 18.8 S 00:19 php-fpm: pool madalice_com_au 1595994 1542510 madalice 159908 12.8 S 00:19 php-fpm: pool madalice_com_au 1596437 1596195 speedlin 144052 72.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596434 1596224 speedlin 139500 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596394 1596320 speedlin 138096 30.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596406 1596256 speedlin 134656 29.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596409 1596201 speedlin 133512 29.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596396 1596308 speedlin 131860 33.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596400 1596323 speedlin 127408 26.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596402 1596196 speedlin 121388 26.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596423 1596218 speedlin 121004 50.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596436 1596133 speedlin 120640 49.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596429 1596226 speedlin 119800 48.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596427 1596222 speedlin 118632 48.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596422 1596216 speedlin 118120 46.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596398 1596104 speedlin 116140 24.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596435 1596108 speedlin 115300 51.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596404 1596130 speedlin 114648 23.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596407 1596206 speedlin 112172 22.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596443 1596127 evolution 109132 50.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1596433 1596260 speedlin 103276 33.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596428 1596223 speedlin 98872 32.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542981 1542551 netdata 95176 0.1 Sl 15:35 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1596426 1596221 speedlin 94020 33.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596431 1596225 speedlin 91632 33.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596432 1596134 speedlin 83412 27.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596424 1596217 speedlin 78956 23.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542487 1 wp-toolkit 77412 0.0 Ss 15:39 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1596425 1596219 speedlin 74168 21.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596430 1596295 speedlin 71408 21.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 65784 0.0 Sl 6-00:18:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 55900 0.0 Ss 6-00:18:20 /usr/lib/systemd/systemd-journald 1542531 1 wp-toolkit 52764 0.0 Ss 15:38 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1542141 1 root 43208 0.0 Ss 15:42 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1353308 1 root 41728 0.1 Ss 42-23:56:46 cpsrvd (SSL) - waiting for connections 1596516 1594752 evolution 40764 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 40072 0.1 Ss 65-16:28:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542510 1 root 37640 0.0 Ss 15:38 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1542072 1 root 36152 0.0 Ss 15:43 lfd - sleeping 1542188 1 root 29284 0.1 Ssl 15:41 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 25380 0.0 Ss 65-16:28:15 tailwatchd 1542555 1 polkitd 23520 0.0 Ssl 15:38 /usr/lib/polkit-1/polkitd --no-debug 1578593 506832 nobody 22416 0.0 S 05:31 /usr/sbin/httpd -k start 1578603 506832 nobody 21860 0.0 S 05:29 /usr/sbin/httpd -k start 1577613 506832 nobody 21188 0.0 S 07:20 /usr/sbin/httpd -k start 1577629 506832 nobody 21096 0.0 S 07:19 /usr/sbin/httpd -k start 1577633 506832 nobody 20688 0.0 S 07:19 /usr/sbin/httpd -k start 1594759 506832 nobody 20520 0.0 S 02:18 /usr/sbin/httpd -k start 1507769 1353308 cpanellogin 19368 0.0 S 24:46 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1595393 506832 nobody 18644 0.0 S 01:24 /usr/sbin/httpd -k start 1577627 506832 nobody 18596 0.0 S 07:19 /usr/sbin/httpd -k start 1581560 506832 nobody 18496 0.0 S 02:59 /usr/sbin/httpd -k start 1596044 506832 nobody 18012 0.0 S 00:15 /usr/sbin/httpd -k start 1594752 506832 nobody 17980 0.2 S 02:19 /usr/sbin/httpd -k start 1596256 506832 nobody 17904 0.0 S 00:11 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1317285 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customkidscom/customkids.com.au 92 evolution/app.evolutionerp.com.au-ssl_log 79 evolution/evolutionerp.com.au 77 speedlin/speedlinefencing.com.au 75 evolution/evolutionerp.com.au-ssl_log 66 vinesit/westpanel.vinesit.com.au 45 vinesit/westpanel.vinesit.com.au-ssl_log 43 evolution/portal.evolutionerp.com.au-ssl_log 22 speedlin/speedlinefencing.com.au-ssl_log 17 madalice/madalice.com.au-ssl_log 8 aaa/aaadownunder.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 5 alison/alisonarts.com.au-ssl_log 4 infinium/infinium.net.au-ssl_log 2 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 142 84.17.60.251 111 192.253.248.173 92 20.104.49.130 87 20.151.10.161 79 40.115.94.245 22 203.54.180.238 6 118.127.40.55 4 94.130.237.182 3 2001:8003:709d:2100:e120:3b27:5d2a:1c87 2 91.92.243.234 2 45.148.10.5 1 91.92.41.55 1 54.234.120.76 1 43.172.198.97 1 43.130.154.56 --- top request paths across all vhosts (last 3 min) --- 79 GET /api/getItem/LWFB2001KG 22 GET /heartbeat.php 6 POST /wp-cron.php 6 GET / 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /red.php 3 GET /ops.php 3 GET /makeasmtp.php 3 GET /mac.php 3 GET /k.php 3 GET /images.php 3 GET /.env 3 GET /classwithtostring.php 3 GET /ccc.php 3 GET /222.php 3 GET /1.php 3 GET /100.php 2 POST /wp-login.php 2 GET /.yarnrc.yml --- busiest 3 vhosts: top paths + last 10 requests --- == customkidscom/customkids.com.au == -- top paths -- 1 GET /zoo2.php 1 GET /yawa.php 1 GET /xwpg.php 1 GET /xmini4.php 1 GET /xa.php 1 GET /x1da.php 1 GET /wsd.php 1 GET /wpxml.php 1 GET /wp.php 1 GET /wp-login.php 1 GET /wp-css.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 20.104.49.130 - - [03/Sep/2026:02:36:56 +1000] "GET /wp-blogs.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:56 +1000] "GET /worksec.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:57 +1000] "GET /browse.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:57 +1000] "GET /002.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:57 +1000] "GET /jp.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:57 +1000] "GET /about.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:58 +1000] "GET /classwithtostring.php HTTP/1.1" 403 13 "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:58 +1000] "GET /666.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:58 +1000] "GET /users.php HTTP/1.1" 404 - "-" "-" 20.104.49.130 - - [03/Sep/2026:02:36:58 +1000] "GET /echkm.php HTTP/1.1" 404 - "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 79 GET /api/getItem/LWFB2001KG -- last 10 requests -- 40.115.94.245 - - [03/Sep/2026:02:37:46 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:47 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:47 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:47 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:48 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:48 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:49 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:49 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:49 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:02:37:50 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == evolution/evolutionerp.com.au == -- top paths -- 1 GET /wp-includes/sodium_compat/src//wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/src/Core//wp-includes/sodium_compat/src/ 1 GET /wp-includes/sodium_compat/src/Core/Curve25519//wp-includes/sodium_compat/src/Core/ 1 GET /wp-includes/sodium_compat/src/Core/Curve25519.php 1 GET /wp-includes/sodium_compat/src/Core/Curve25519/Fe.php 1 GET /wp-includes/sodium_compat/src/Core/Curve25519/ 1 GET /wp-includes/sodium_compat/src/Core/ChaCha20//wp-includes/sodium_compat/src/Core/ 1 GET /wp-includes/sodium_compat/src/Core/ChaCha20.php 1 GET /wp-includes/sodium_compat/src/Core/ChaCha20/IetfCtx.php 1 GET /wp-includes/sodium_compat/src/Core/ChaCha20/Ctx.php 1 GET /wp-includes/sodium_compat/src/Core/ChaCha20/ 1 GET /wp-includes/sodium_compat/src/Core/BLAKE2b.php -- last 10 requests -- 84.17.60.251 - - [03/Sep/2026:02:37:43 +1000] "GET /wp-includes/sodium_compat/src/Core/Base64/UrlSafe.php HTTP/1.1" 301 329 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:43 +1000] "GET /wp-includes/sodium_compat/src/Core/ChaCha20.php HTTP/1.1" 301 323 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:44 +1000] "GET /wp-includes/sodium_compat/src/Core/ChaCha20/ HTTP/1.1" 301 320 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:45 +1000] "GET /wp-includes/sodium_compat/src/Core/ChaCha20//wp-includes/sodium_compat/src/Core/ HTTP/1.1" 301 355 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:48 +1000] "GET /wp-includes/sodium_compat/src/Core/ChaCha20/Ctx.php HTTP/1.1" 301 327 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:49 +1000] "GET /wp-includes/sodium_compat/src/Core/ChaCha20/IetfCtx.php HTTP/1.1" 301 331 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:53 +1000] "GET /wp-includes/sodium_compat/src/Core/Curve25519.php HTTP/1.1" 301 325 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:54 +1000] "GET /wp-includes/sodium_compat/src/Core/Curve25519/ HTTP/1.1" 301 322 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:56 +1000] "GET /wp-includes/sodium_compat/src/Core/Curve25519//wp-includes/sodium_compat/src/Core/ HTTP/1.1" 301 357 "-" "-" 84.17.60.251 - - [03/Sep/2026:02:37:58 +1000] "GET /wp-includes/sodium_compat/src/Core/Curve25519/Fe.php HTTP/1.1" 301 328 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-03 02:35:34 L1=0.83 run=1 blk=0 avail=9697 (70.4%) swpO=0 conn=1 myRSS=2175 php=3 phpRSS=175 ap=17 tcp=32 topuser=madalice 2026-09-03 02:35:41 L1=0.84 run=3 blk=0 avail=9633 (69.9%) swpO=0 conn=2 myRSS=2175 php=4 phpRSS=266 ap=17 tcp=30 topuser=madalice 2026-09-03 02:35:44 L1=0.86 run=5 blk=0 avail=9487 (68.9%) swpO=0 conn=1 myRSS=2175 php=6 phpRSS=455 ap=20 tcp=35 topuser=infinium 2026-09-03 02:35:51 L1=0.95 run=1 blk=0 avail=9675 (70.2%) swpO=0 conn=2 myRSS=2175 php=3 phpRSS=175 ap=20 tcp=30 topuser=madalice 2026-09-03 02:35:54 L1=0.87 run=1 blk=0 avail=9691 (70.3%) swpO=0 conn=1 myRSS=2175 php=3 phpRSS=175 ap=18 tcp=32 topuser=madalice 2026-09-03 02:36:01 L1=0.88 run=1 blk=0 avail=9784 (71.0%) swpO=0 conn=2 myRSS=2175 php=2 phpRSS=38 ap=18 tcp=27 topuser=root 2026-09-03 02:36:05 L1=0.81 run=2 blk=0 avail=9643 (70.0%) swpO=0 conn=1 myRSS=2175 php=4 phpRSS=267 ap=16 tcp=32 topuser=customc 2026-09-03 02:36:11 L1=0.75 run=1 blk=0 avail=9718 (70.5%) swpO=0 conn=2 myRSS=2175 php=3 phpRSS=175 ap=16 tcp=28 topuser=madalice 2026-09-03 02:36:15 L1=0.77 run=2 blk=0 avail=9607 (69.7%) swpO=0 conn=1 myRSS=2175 php=4 phpRSS=317 ap=16 tcp=29 topuser=evolution 2026-09-03 02:36:21 L1=0.70 run=2 blk=0 avail=9568 (69.5%) swpO=1 conn=2 myRSS=2175 php=4 phpRSS=354 ap=16 tcp=29 topuser=evolution 2026-09-03 02:36:25 L1=0.65 run=5 blk=0 avail=9671 (70.2%) swpO=1 conn=1 myRSS=2175 php=5 phpRSS=279 ap=16 tcp=31 topuser=madalice 2026-09-03 02:36:31 L1=0.60 run=1 blk=0 avail=9686 (70.3%) swpO=0 conn=2 myRSS=2175 php=3 phpRSS=198 ap=16 tcp=30 topuser=madalice 2026-09-03 02:36:35 L1=0.63 run=3 blk=0 avail=9476 (68.8%) swpO=0 conn=1 myRSS=2175 php=5 phpRSS=465 ap=16 tcp=33 topuser=evolution 2026-09-03 02:36:41 L1=0.58 run=2 blk=0 avail=9625 (69.9%) swpO=0 conn=1 myRSS=2175 php=4 phpRSS=238 ap=23 tcp=33 topuser=madalice 2026-09-03 02:36:45 L1=0.53 run=2 blk=0 avail=9481 (68.8%) swpO=0 conn=1 myRSS=2175 php=4 phpRSS=383 ap=22 tcp=35 topuser=corpkicks 2026-09-03 02:36:51 L1=0.57 run=1 blk=0 avail=9657 (70.1%) swpO=0 conn=1 myRSS=2175 php=3 phpRSS=198 ap=20 tcp=28 topuser=madalice 2026-09-03 02:36:55 L1=0.52 run=3 blk=0 avail=9576 (69.5%) swpO=0 conn=2 myRSS=2175 php=4 phpRSS=317 ap=18 tcp=31 topuser=madalice 2026-09-03 02:37:01 L1=0.48 run=1 blk=0 avail=9668 (70.2%) swpO=0 conn=1 myRSS=2175 php=3 phpRSS=198 ap=18 tcp=29 topuser=madalice 2026-09-03 02:37:05 L1=0.44 run=1 blk=0 avail=9800 (71.1%) swpO=0 conn=2 myRSS=2175 php=2 phpRSS=38 ap=17 tcp=32 topuser=root 2026-09-03 02:37:11 L1=0.49 run=3 blk=0 avail=9603 (69.7%) swpO=0 conn=1 myRSS=2175 php=4 phpRSS=297 ap=17 tcp=32 topuser=madalice 2026-09-03 02:37:15 L1=0.61 run=1 blk=0 avail=9684 (70.3%) swpO=0 conn=2 myRSS=2175 php=3 phpRSS=175 ap=18 tcp=33 topuser=madalice 2026-09-03 02:37:21 L1=0.64 run=2 blk=0 avail=9574 (69.5%) swpO=0 conn=1 myRSS=2175 php=4 phpRSS=319 ap=18 tcp=32 topuser=alison 2026-09-03 02:37:25 L1=0.59 run=1 blk=0 avail=9700 (70.4%) swpO=2 conn=2 myRSS=2175 php=3 phpRSS=175 ap=18 tcp=32 topuser=madalice 2026-09-03 02:37:31 L1=0.70 run=1 blk=0 avail=9571 (69.5%) swpO=2 conn=1 myRSS=2175 php=4 phpRSS=299 ap=21 tcp=38 topuser=madalice 2026-09-03 02:37:35 L1=0.65 run=4 blk=0 avail=9710 (70.5%) swpO=2 conn=2 myRSS=2175 php=3 phpRSS=150 ap=21 tcp=36 topuser=customc 2026-09-03 02:37:42 L1=0.59 run=2 blk=0 avail=9714 (70.5%) swpO=1 conn=1 myRSS=2175 php=2 phpRSS=38 ap=20 tcp=30 topuser=root 2026-09-03 02:37:45 L1=0.63 run=1 blk=0 avail=9342 (67.8%) swpO=0 conn=2 myRSS=2175 php=4 phpRSS=315 ap=19 tcp=140 topuser=madalice 2026-09-03 02:37:52 L1=0.58 run=3 blk=0 avail=8791 (63.8%) swpO=27 conn=1 myRSS=2174 php=5 phpRSS=353 ap=114 tcp=174 topuser=madalice 2026-09-03 02:37:55 L1=0.69 run=3 blk=0 avail=8425 (61.2%) swpO=641 conn=1 myRSS=2153 php=6 phpRSS=412 ap=146 tcp=122 topuser=madalice 2026-09-03 02:38:02 L1=0.72 run=37 blk=0 avail=6567 (47.7%) swpO=1470 conn=28 myRSS=2122 php=32 phpRSS=3202 ap=140 tcp=62 topuser=speedlin