INCIDENT 2026-09-03 19:47:55 trigger: php_rss=1802MB mysql_conn=19 ================================================================== load: 2.71 1.35 0.99 21/747 1186679 ncpu:10 mem_avail: 6827MB/13777MB (49.6%) swap_used:1540MB swapout:0/s blocked(D):0 running:29 iowait:0.0% steal:0.0% php: 24 procs / 1802MB heaviest user: aaa (20 procs, 1598MB) apache: 76 procs tcp_estab: 64 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2966 aaa 18 1509 nobody 75 1177 root 247 1100 netdata 8 249 madalice 1 133 wp-toolkit 3 67 evolution 10 58 cpanellogin 1 28 mailman 20 27 dovenull 6 26 mailnull 4 21 zabbix 1 12 vinesit 1 12 polkitd 1 11 kurri 1 11 dovecot 3 8 named 1 5 nscd 1 4 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB aaa 16 1424 madalice 1 133 evolution 3 67 root 1 30 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6155 MB Active(file): 4786 MB Inactive(file): 974 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 472 MB CommitLimit: 10984 MB Committed_AS: 10594 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 2-17:25:27 4556 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3037288 15.3 Ssl 1-05:33:42 /usr/sbin/mariadbd 1542443 1 netdata 182924 2.5 Ssl 17:25:32 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 509266 1 root 175232 0.0 Ss 6-17:28:13 /usr/lib/systemd/systemd-journald 1596048 1543747 root 174204 0.0 S 17:10:07 spamd child 4117331 1543747 root 173392 0.0 S 05:43:10 spamd child 1186481 1542510 madalice 136748 15.0 S 00:08 php-fpm: pool madalice_com_au 1543747 1 root 119460 0.0 Ss 17:25:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1186582 1186277 aaa 99856 25.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186620 1185970 aaa 99644 36.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186616 1185969 aaa 99344 37.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186583 1186269 aaa 99272 24.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186617 1185959 aaa 98300 35.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186590 1186576 aaa 98128 24.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186587 1186575 aaa 97348 24.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186615 1186271 aaa 97060 37.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186621 1186152 aaa 97024 37.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186596 1185935 aaa 94724 32.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186602 1186251 aaa 93064 32.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186599 1185971 aaa 91652 31.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186614 1184815 aaa 88332 29.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186601 1186561 aaa 85260 26.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186604 1185946 aaa 82616 24.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186603 1186247 aaa 82536 25.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186689 1186606 aaa 47132 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186691 1186226 aaa 46476 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 45532 0.0 Sl 6-17:28:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42308 0.1 Ss 43-17:06:39 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 42068 0.1 Sl 17:25:28 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 41932 0.1 Ss 66-09:38:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1186652 1469 root 38960 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 37136 0.0 Ss 17:25:32 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1186692 1186562 aaa 35624 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186690 1186610 aaa 34892 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542072 1 root 32440 0.0 Ss 17:25:36 lfd - sleeping 1542510 1 root 31644 0.0 Ss 17:25:31 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1065238 1353308 cpanellogin 29348 0.0 S 36:51 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1542531 1 wp-toolkit 25132 0.0 Ss 17:25:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 24744 0.0 Ss 66-09:38:08 tailwatchd 1184815 506832 nobody 22804 0.0 S 02:35 /usr/sbin/httpd -k start 1542141 1 root 22732 0.0 Ss 17:25:35 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1542188 1 root 22280 0.1 Ssl 17:25:34 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1185969 506832 nobody 22216 0.1 S 00:45 /usr/sbin/httpd -k start 1186270 506832 nobody 22140 0.2 S 00:18 /usr/sbin/httpd -k start 1186277 506832 nobody 21796 0.1 S 00:18 /usr/sbin/httpd -k start 1185935 506832 nobody 21544 0.0 S 00:47 /usr/sbin/httpd -k start 1186273 506832 nobody 21484 0.2 S 00:18 /usr/sbin/httpd -k start 1185942 506832 nobody 21356 0.1 S 00:46 /usr/sbin/httpd -k start 1184796 506832 nobody 21348 0.1 S 02:37 /usr/sbin/httpd -k start 1185959 506832 nobody 21304 0.0 S 00:45 /usr/sbin/httpd -k start 1185970 506832 nobody 21276 0.1 S 00:45 /usr/sbin/httpd -k start 1185965 506832 nobody 21220 0.2 R 00:45 /usr/sbin/httpd -k start 1186247 506832 nobody 21188 0.1 S 00:19 /usr/sbin/httpd -k start 1186271 506832 nobody 21176 0.1 S 00:18 /usr/sbin/httpd -k start 1186152 506832 nobody 21064 0.1 S 00:22 /usr/sbin/httpd -k start 1185932 506832 nobody 21012 0.0 S 00:48 /usr/sbin/httpd -k start 1185941 506832 nobody 20952 0.2 S 00:46 /usr/sbin/httpd -k start 1184759 506832 nobody 20928 0.0 S 02:40 /usr/sbin/httpd -k start 1184776 506832 nobody 20864 0.0 S 02:39 /usr/sbin/httpd -k start 1186269 506832 nobody 20840 0.1 S 00:18 /usr/sbin/httpd -k start 1186228 506832 nobody 20788 0.1 S 00:20 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 6599609 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 260 evolution/app.evolutionerp.com.au-ssl_log 162 aaa/aaadownunder.com.au-ssl_log 153 madalice/madalice.com.au-ssl_log 84 aaa/aaadownunder.com.au 47 evolution/evolutionerp.com.au-ssl_log 19 evolution/portal.evolutionerp.com.au-ssl_log 6 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 260 34.92.68.48 215 213.209.159.133 162 40.115.94.245 19 45.156.129.120 18 34.118.131.135 15 45.156.129.123 15 118.127.40.55 13 45.156.129.122 13 45.156.129.121 6 203.54.180.238 3 104.248.87.72 2 74.7.229.100 2 114.119.140.234 1 74.7.244.15 1 74.7.243.64 --- top request paths across all vhosts (last 3 min) --- 70 GET /api/getItem/LWPB2001KG 53 GET /api/getItem/LWFBW2001KG 19 POST / 10 GET /api/getItem/LWHG2001KG 7 GET /index.php/2020/10/25/magenta-screw-piles-part-1/ 6 GET /index.php/2020/09/21/waratah-piers/ 6 GET /heartbeat.php 5 GET /index.php/2020/09/25/cardiff-piers/ 5 GET / 4 GET /index.php/projects/ 4 GET /index.php/blog/page/2/ 4 GET /index.php/about-us/ 4 GET /index.php/2019/11/25/stairs/ 4 GET /index.php/2019/08/29/stabilizing-fireplaces/ 3 POST /wp-login.php 3 GET /index.php/blog/page/3/ 3 GET /index.php/2025/05/23/maitland-full-house-pier-replacement/ 3 GET /index.php/2025/05/ 3 GET /index.php/2022/03/07/tree-mulcher/ 3 GET /index.php/2022/03/ --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.92.68.48 - - [03/Sep/2026:19:47:44 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:45 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.68.48 - - [03/Sep/2026:19:47:46 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 70 GET /api/getItem/LWPB2001KG 53 GET /api/getItem/LWFBW2001KG 10 GET /api/getItem/LWHG2001KG 2 GET /api/getItem/H5025D 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/KEB-8MM-CHAIN -- last 10 requests -- 40.115.94.245 - - [03/Sep/2026:19:47:47 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:47 +1000] "GET /api/getItem/GEB12-DL HTTP/1.1" 200 1526 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:47 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:47 +1000] "GET /api/getItem/GEB12-DL HTTP/1.1" 200 1526 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:47 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:48 +1000] "GET /api/getItem/GEB16 HTTP/1.1" 404 107 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:48 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:48 +1000] "GET /api/getItem/KEB-8MM-CHAIN HTTP/1.1" 200 1626 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:48 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:19:47:48 +1000] "GET /api/getItem/KEB10MMCHAIN HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 5 GET /index.php/2020/10/25/magenta-screw-piles-part-1/ 4 GET /index.php/2020/09/25/cardiff-piers/ 4 GET /index.php/2020/09/21/waratah-piers/ 3 GET /index.php/projects/ 3 GET /index.php/blog/page/2/ 3 GET /index.php/about-us/ 3 GET /index.php/2025/05/23/maitland-full-house-pier-replacement/ 3 GET /index.php/2022/03/07/tree-mulcher/ 3 GET /index.php/2022/01/31/pokolbin-screw-piles/ 3 GET /index.php/2022/01/31/broadmeadow-screw-piles-2/ 3 GET /index.php/2021/10/19/new-lambton-re-pier-and-relevel/ 3 GET /index.php/2021/10/19/charlestown-swim-centre-piles/ -- last 10 requests -- 213.209.159.133 - - [03/Sep/2026:19:47:52 +1000] "GET /index.php/2019/11/25/stairs/ HTTP/1.1" 200 12003 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:52 +1000] "GET /index.php/2020/02/19/king-street-newcastle/ HTTP/1.1" 200 12334 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:52 +1000] "GET /index.php/2019/11/06/malabar/ HTTP/1.1" 200 12306 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:52 +1000] "GET /index.php/2020/01/16/medowie-school/ HTTP/1.1" 200 12286 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:53 +1000] "GET /index.php/2019/09/02/wallsend-ambulance-station-stage-2/ HTTP/1.1" 200 12157 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:52 +1000] "GET /index.php/2019/12/02/bronte/ HTTP/1.1" 200 12186 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:53 +1000] "GET /index.php/2019/08/29/stabilizing-fireplaces/ HTTP/1.1" 200 12163 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:53 +1000] "GET /index.php/2019/09/09/caddens-shopping-centre/ HTTP/1.1" 200 12130 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:53 +1000] "GET /index.php/2019/09/09/caddens-shopping-centre/ HTTP/1.1" 200 12130 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [03/Sep/2026:19:47:53 +1000] "GET /index.php/2019/09/23/neath-piers/ HTTP/1.1" 200 12116 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" --- last 30 samples (run-up to this incident) --- 2026-09-03 19:45:34 L1=2.41 run=1 blk=0 avail=6954 (50.5%) swpO=0 conn=1 myRSS=2960 php=12 phpRSS=1628 ap=44 tcp=34 topuser=madalice 2026-09-03 19:45:34 L1=2.41 run=1 blk=0 avail=6954 (50.5%) swpO=0 conn=1 myRSS=2960 php=12 phpRSS=1628 ap=44 tcp=34 topuser=madalice 2026-09-03 19:45:44 L1=2.04 run=2 blk=0 avail=6928 (50.3%) swpO=0 conn=2 myRSS=2965 php=13 phpRSS=1767 ap=34 tcp=31 topuser=madalice 2026-09-03 19:45:44 L1=2.04 run=4 blk=0 avail=6897 (50.1%) swpO=0 conn=2 myRSS=2965 php=13 phpRSS=1799 ap=34 tcp=32 topuser=madalice 2026-09-03 19:45:54 L1=1.88 run=1 blk=0 avail=7248 (52.6%) swpO=0 conn=2 myRSS=2965 php=11 phpRSS=1468 ap=24 tcp=23 topuser=madalice 2026-09-03 19:45:54 L1=1.88 run=1 blk=0 avail=7248 (52.6%) swpO=0 conn=1 myRSS=2965 php=11 phpRSS=1468 ap=24 tcp=22 topuser=madalice 2026-09-03 19:46:04 L1=1.66 run=3 blk=0 avail=7429 (53.9%) swpO=0 conn=1 myRSS=2965 php=10 phpRSS=1309 ap=18 tcp=27 topuser=madalice 2026-09-03 19:46:04 L1=1.66 run=1 blk=0 avail=7430 (53.9%) swpO=0 conn=1 myRSS=2965 php=10 phpRSS=1309 ap=18 tcp=25 topuser=madalice 2026-09-03 19:46:14 L1=1.48 run=1 blk=0 avail=7726 (56.1%) swpO=0 conn=1 myRSS=2965 php=8 phpRSS=988 ap=15 tcp=21 topuser=madalice 2026-09-03 19:46:14 L1=1.48 run=1 blk=0 avail=7725 (56.1%) swpO=0 conn=1 myRSS=2965 php=8 phpRSS=988 ap=15 tcp=21 topuser=madalice 2026-09-03 19:46:24 L1=1.25 run=2 blk=0 avail=7680 (55.7%) swpO=0 conn=1 myRSS=2965 php=9 phpRSS=1080 ap=14 tcp=21 topuser=madalice 2026-09-03 19:46:24 L1=1.25 run=2 blk=0 avail=7659 (55.6%) swpO=0 conn=1 myRSS=2965 php=9 phpRSS=1097 ap=14 tcp=21 topuser=madalice 2026-09-03 19:46:34 L1=1.21 run=3 blk=0 avail=8128 (59.0%) swpO=0 conn=1 myRSS=2965 php=5 phpRSS=512 ap=14 tcp=23 topuser=madalice 2026-09-03 19:46:34 L1=1.21 run=1 blk=0 avail=8137 (59.1%) swpO=0 conn=1 myRSS=2965 php=5 phpRSS=512 ap=14 tcp=23 topuser=madalice 2026-09-03 19:46:44 L1=1.19 run=1 blk=0 avail=8550 (62.1%) swpO=0 conn=1 myRSS=2965 php=2 phpRSS=30 ap=14 tcp=20 topuser=root 2026-09-03 19:46:44 L1=1.19 run=1 blk=0 avail=8550 (62.1%) swpO=0 conn=1 myRSS=2965 php=2 phpRSS=30 ap=14 tcp=20 topuser=root 2026-09-03 19:46:54 L1=1.00 run=3 blk=0 avail=8399 (61.0%) swpO=0 conn=1 myRSS=2965 php=4 phpRSS=231 ap=14 tcp=25 topuser=madalice 2026-09-03 19:46:54 L1=1.00 run=2 blk=0 avail=8370 (60.8%) swpO=0 conn=2 myRSS=2965 php=4 phpRSS=259 ap=14 tcp=25 topuser=madalice 2026-09-03 19:47:04 L1=0.93 run=1 blk=0 avail=8408 (61.0%) swpO=0 conn=1 myRSS=2966 php=3 phpRSS=187 ap=14 tcp=25 topuser=madalice 2026-09-03 19:47:04 L1=0.93 run=1 blk=0 avail=8406 (61.0%) swpO=0 conn=2 myRSS=2966 php=3 phpRSS=187 ap=14 tcp=25 topuser=madalice 2026-09-03 19:47:14 L1=1.11 run=1 blk=0 avail=8234 (59.8%) swpO=0 conn=1 myRSS=2966 php=3 phpRSS=187 ap=42 tcp=32 topuser=madalice 2026-09-03 19:47:14 L1=1.11 run=1 blk=0 avail=8233 (59.8%) swpO=0 conn=2 myRSS=2966 php=3 phpRSS=187 ap=42 tcp=32 topuser=madalice 2026-09-03 19:47:24 L1=1.02 run=10 blk=0 avail=8100 (58.8%) swpO=0 conn=1 myRSS=2966 php=10 phpRSS=585 ap=32 tcp=41 topuser=aaa 2026-09-03 19:47:24 L1=1.02 run=8 blk=0 avail=8017 (58.2%) swpO=0 conn=2 myRSS=2966 php=10 phpRSS=676 ap=32 tcp=41 topuser=aaa 2026-09-03 19:47:34 L1=1.82 run=16 blk=0 avail=7810 (56.7%) swpO=0 conn=1 myRSS=2966 php=16 phpRSS=1072 ap=28 tcp=98 topuser=aaa 2026-09-03 19:47:35 L1=1.82 run=16 blk=0 avail=7821 (56.8%) swpO=0 conn=2 myRSS=2966 php=14 phpRSS=969 ap=28 tcp=98 topuser=aaa 2026-09-03 19:47:44 L1=3.03 run=1 blk=0 avail=8239 (59.8%) swpO=0 conn=1 myRSS=2966 php=2 phpRSS=30 ap=51 tcp=41 topuser=root 2026-09-03 19:47:45 L1=3.03 run=2 blk=0 avail=8230 (59.7%) swpO=0 conn=2 myRSS=2966 php=3 phpRSS=61 ap=51 tcp=40 topuser=root 2026-09-03 19:47:55 L1=2.71 run=29 blk=0 avail=6827 (49.6%) swpO=0 conn=19 myRSS=2966 php=24 phpRSS=1802 ap=76 tcp=64 topuser=aaa 2026-09-03 19:47:55 L1=4.26 run=26 blk=0 avail=6976 (50.6%) swpO=0 conn=13 myRSS=2966 php=21 phpRSS=1633 ap=76 tcp=49 topuser=aaa