INCIDENT 2026-09-04 22:17:48 trigger: swapout=2399/s ================================================================== load: 1.08 0.68 0.66 2/669 2783363 ncpu:10 mem_avail: 4728MB/13777MB (34.3%) swap_used:1624MB swapout:2399/s blocked(D):2 running:4 iowait:5.2% steal:0.0% php: 5 procs / 348MB heaviest user: madalice (1 procs, 155MB) apache: 18 procs tcp_estab: 25 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3361 evolution 13 2946 root 246 1154 nobody 17 298 netdata 8 253 madalice 1 155 olympic 1 122 dovenull 6 68 cpanellogin 1 62 wp-toolkit 3 57 dovecot 3 29 kurri 2 28 mailman 20 26 lowrange 1 14 zabbix 1 10 polkitd 1 7 named 1 5 mailnull 2 5 nscd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 1 155 olympic 1 122 evolution 2 39 root 1 32 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4327 MB Active(file): 2475 MB Inactive(file): 1902 MB Dirty: 133 MB Writeback: 27 MB SReclaimable: 517 MB CommitLimit: 10984 MB Committed_AS: 9958 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2781800 root 01:52 55096 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 3-19:55:21 4108 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3440224 13.3 Ssl 2-08:03:36 /usr/sbin/mariadbd 2783198 2783197 evolution 2910160 89.2 RNs 00:14 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 1043892 2603077 root 198824 0.1 S 08:12:52 spamd child 1542443 1 netdata 187776 2.6 Ssl 1-19:55:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2783060 2601907 madalice 158896 9.8 S 00:25 php-fpm: pool madalice_com_au 2654376 2603077 root 145344 0.0 S 19:38:41 spamd child 509266 1 root 143404 0.0 Ss 7-19:58:07 /usr/lib/systemd/systemd-journald 2603077 1 root 135476 0.0 Ss 19:53:37 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2783317 2749443 olympic 125580 35.6 D 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2507165 1353308 cpanellogin 63592 0.0 S 01:18:36 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2781800 1 root 55096 1.1 Ssl 01:52 /opt/imunify360/venv/bin/python3 -m imav.run 2781667 654626 root 44124 0.8 SN 02:04 cpanellogd - waiting for child to process logs for evolution 509236 509098 root 43452 0.0 Sl 7-19:58:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2783147 2781667 evolution 42248 0.2 SN 00:18 cpanellogd - http logs for evolution 1353308 1 root 41840 0.1 Ss 44-19:36:33 cpsrvd (SSL) - waiting for connections 1469 1 root 41440 0.1 Ss 67-12:08:02 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542981 1542551 netdata 40892 0.1 Sl 1-19:55:22 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2783325 2782595 evolution 40776 2.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2783332 1469 root 38564 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2783374 1469 root 38560 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2601907 1 root 32804 0.0 Ss 19:54:22 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1542487 1 wp-toolkit 32152 0.0 Ss 1-19:55:26 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2602226 1 root 26452 0.1 Ssl 19:54:07 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 25664 0.0 Ss 67-12:08:02 tailwatchd 2766661 506832 nobody 22688 0.0 S 03:48 /usr/sbin/httpd -k start 2766389 506832 nobody 22360 0.0 S 04:24 /usr/sbin/httpd -k start 2782728 506832 nobody 22072 0.1 S 00:50 /usr/sbin/httpd -k start 2766708 506832 nobody 21892 0.0 S 03:46 /usr/sbin/httpd -k start 2749443 506832 nobody 21796 0.0 S 08:37 /usr/sbin/httpd -k start 2766698 506832 nobody 21124 0.0 S 03:47 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 20080 0.0 Ss 1-19:55:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766395 506832 nobody 19936 0.0 S 04:23 /usr/sbin/httpd -k start 2766709 506832 nobody 19884 0.0 S 03:46 /usr/sbin/httpd -k start 2782595 506832 nobody 19588 0.0 S 00:51 /usr/sbin/httpd -k start 2782726 506832 nobody 19532 0.0 S 00:50 /usr/sbin/httpd -k start 2782597 506832 nobody 19400 0.0 S 00:51 /usr/sbin/httpd -k start 2783138 506832 nobody 18804 0.0 S 00:20 /usr/sbin/httpd -k start 2782729 506832 nobody 18448 0.0 S 00:50 /usr/sbin/httpd -k start 1542982 1542551 netdata 18224 2.1 Sl 1-19:55:22 /usr/libexec/netdata/plugins.d/apps.plugin 1 2782537 506832 nobody 17900 0.0 S 00:52 /usr/sbin/httpd -k start 1542141 1 root 17104 0.0 Ss 1-19:55:29 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 690513 508511 root 16900 0.0 S 09:44:58 dovecot/config 2748829 508511 kurri 15348 0.0 S 09:37 dovecot/imap 2781773 508511 lowrange 14444 0.0 S 01:56 dovecot/imap 2782061 506832 nobody 14264 0.0 S 01:39 /usr/sbin/httpd -k start 706620 508511 kurri 14200 0.0 S 09:42:35 dovecot/imap 2508826 1471 root 14172 0.0 S 20:20:51 cPhulkd - dbprocessor 1471 1 root 14092 0.0 Ss 67-12:08:02 cPhulkd - processor 690514 508511 dovecot 13956 0.0 S 09:44:58 dovecot/auth 506832 1 root 13408 0.0 Ss 7-19:58:40 /usr/sbin/httpd -k start 690509 508511 dovenull 13292 0.0 S 09:44:58 dovecot/imap-login 690505 508511 dovenull 13216 0.0 S 09:44:58 dovecot/imap-login 2782968 508511 root 12980 0.0 S 00:35 dovecot/auth -w 690511 508511 dovenull 11848 0.0 S 09:44:58 dovecot/pop3-login 690507 508511 dovenull 11336 0.0 S 09:44:58 dovecot/pop3-login 483898 1 zabbix 11220 0.2 Ssl 7-19:59:24 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 690506 508511 dovenull 10464 0.0 S 09:44:58 dovecot/managesieve-login 690510 508511 dovenull 9656 0.0 S 09:44:58 dovecot/managesieve-login 1542117 1 root 8624 0.0 Ss 1-19:55:30 /usr/bin/VGAuthService -s 1542555 1 polkitd 8120 0.0 Ssl 1-19:55:25 /usr/lib/polkit-1/polkitd --no-debug --- processes in D state (uninterruptible IO) --- 121 D - [kswapd0] 2642911 D - [kworker/u256:2+flush-8:0] 2783317 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10512305 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 119 speedlin/speedlinefencing.com.au-ssl_log 23 alison/alisonarts.com.au-ssl_log 18 kamcool/kamcool.com.au 18 evolution/portal.evolutionerp.com.au-ssl_log 12 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 117 34.17.32.127 22 4.204.224.164 18 185.104.184.228 16 45.148.10.247 12 203.54.180.238 4 118.127.40.55 1 17.166.237.91 --- top request paths across all vhosts (last 3 min) --- 12 GET /heartbeat.php 7 POST / 6 GET / 3 POST /index.php 3 GET /wp-json/gravitysmtp/v1/tests/mock-data 2 POST /wp/index.php 2 POST /wp-cron.php 2 POST /wordpress/index.php 1 POST /blog/index.php 1 GET /zend/.env 1 GET /yii/.env 1 GET /xmlrpc.php 1 GET /www/.env 1 GET /wp/wp-includes/wlwmanifest.xml 1 GET /wp-login.php 1 GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema 1 GET /wp-includes/wlwmanifest.xml 1 GET /wp/.env 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp2/wp-includes/wlwmanifest.xml --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 4 POST / 2 POST /wp-cron.php 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vendor/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /v3/.env -- last 10 requests -- 34.17.32.127 - - [04/Sep/2026:22:17:44 +1000] "GET /tools/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:44 +1000] "GET /scripts/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:45 +1000] "GET /bin/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:45 +1000] "GET /sbin/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:45 +1000] "GET /local/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:46 +1000] "GET /portal/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:46 +1000] "GET /dashboard/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:46 +1000] "GET /panel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:47 +1000] "GET /crm/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:17:47 +1000] "GET /erp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 1 GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /simple.php 1 GET /radio.php 1 GET /ops.php 1 GET /media.php 1 GET /mac.php 1 GET /k.php 1 GET /images.php 1 GET /images2.php 1 GET /fling.php -- last 10 requests -- 4.204.224.164 - - [04/Sep/2026:22:17:34 +1000] "GET /k.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:35 +1000] "GET /dex.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:35 +1000] "GET /222.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:36 +1000] "GET /chosen.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:36 +1000] "GET /1.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:36 +1000] "GET /fling.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:37 +1000] "GET /radio.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:37 +1000] "GET /mac.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:38 +1000] "GET /simple.php HTTP/1.1" 401 36 "-" "-" 17.166.237.91 - - [04/Sep/2026:22:17:35 +1000] "GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema HTTP/1.1" 200 221 "https://speedlinefencing.com.au/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Apple == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 POST /index.php 3 POST / 3 GET /wp-json/gravitysmtp/v1/tests/mock-data 2 POST /wp/index.php 2 POST /wordpress/index.php 2 GET / 1 POST /blog/index.php 1 GET /wp-login.php 1 GET /index.php -- last 10 requests -- 45.148.10.247 - - [04/Sep/2026:22:15:59 +1000] "GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-connections HTTP/1.1" 404 114 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" 45.148.10.247 - - [04/Sep/2026:22:16:01 +1000] "GET /?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-connections HTTP/1.1" 404 114 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Fire 45.148.10.247 - - [04/Sep/2026:22:16:03 +1000] "GET /index.php?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings HTTP/1.1" 403 17006 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWeb 45.148.10.247 - - [04/Sep/2026:22:16:07 +1000] "GET /wp-json/gravitysmtp/v1/tests/mock-data HTTP/1.1" 404 114 "-" "Mozilla/5.0 (Linux; Android 13; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile 118.127.40.55 - - [04/Sep/2026:22:16:09 +1000] "POST /?wordfence_syncAttackData=1788524169.674 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://alisonarts.com.au" 45.148.10.247 - - [04/Sep/2026:22:16:08 +1000] "POST /wp/index.php?rest_route=/batch/v1 HTTP/1.1" 207 16 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 45.148.10.247 - - [04/Sep/2026:22:16:11 +1000] "POST /wp/index.php?rest_route=/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 45.148.10.247 - - [04/Sep/2026:22:16:13 +1000] "POST /wordpress/index.php?rest_route=/batch/v1 HTTP/1.1" 207 16 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar 45.148.10.247 - - [04/Sep/2026:22:16:14 +1000] "POST /wordpress/index.php?rest_route=/batch/v1 HTTP/1.1" 207 478 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safa 45.148.10.247 - - [04/Sep/2026:22:16:18 +1000] "POST /blog/index.php?rest_route=/batch/v1 HTTP/1.1" 207 16 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 --- last 30 samples (run-up to this incident) --- 2026-09-04 22:15:27 L1=0.22 run=1 blk=0 avail=7787 (56.5%) swpO=1 conn=2 myRSS=3421 php=3 phpRSS=71 ap=14 tcp=23 topuser=evolution 2026-09-04 22:15:27 L1=0.22 run=1 blk=0 avail=7785 (56.5%) swpO=1 conn=3 myRSS=3421 php=3 phpRSS=71 ap=14 tcp=24 topuser=evolution 2026-09-04 22:15:37 L1=0.19 run=1 blk=0 avail=7652 (55.5%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=228 ap=14 tcp=25 topuser=madalice 2026-09-04 22:15:38 L1=0.19 run=3 blk=0 avail=7650 (55.5%) swpO=0 conn=3 myRSS=3421 php=4 phpRSS=228 ap=14 tcp=23 topuser=madalice 2026-09-04 22:15:47 L1=0.16 run=4 blk=0 avail=7414 (53.8%) swpO=0 conn=2 myRSS=3421 php=5 phpRSS=384 ap=13 tcp=23 topuser=madalice 2026-09-04 22:15:48 L1=0.16 run=5 blk=0 avail=7479 (54.3%) swpO=0 conn=3 myRSS=3421 php=5 phpRSS=316 ap=13 tcp=23 topuser=madalice 2026-09-04 22:15:57 L1=0.44 run=2 blk=0 avail=7514 (54.5%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=227 ap=13 tcp=24 topuser=madalice 2026-09-04 22:15:58 L1=0.44 run=3 blk=0 avail=7569 (54.9%) swpO=0 conn=3 myRSS=3421 php=4 phpRSS=227 ap=13 tcp=24 topuser=madalice 2026-09-04 22:16:07 L1=0.53 run=4 blk=0 avail=7233 (52.5%) swpO=0 conn=2 myRSS=3421 php=5 phpRSS=319 ap=13 tcp=26 topuser=madalice 2026-09-04 22:16:08 L1=0.53 run=6 blk=0 avail=7184 (52.1%) swpO=0 conn=3 myRSS=3421 php=5 phpRSS=345 ap=13 tcp=26 topuser=madalice 2026-09-04 22:16:17 L1=0.68 run=3 blk=0 avail=6782 (49.2%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=204 ap=14 tcp=20 topuser=madalice 2026-09-04 22:16:18 L1=0.68 run=2 blk=0 avail=6782 (49.2%) swpO=0 conn=3 myRSS=3421 php=4 phpRSS=204 ap=14 tcp=20 topuser=madalice 2026-09-04 22:16:28 L1=0.82 run=3 blk=0 avail=7571 (55.0%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=204 ap=14 tcp=21 topuser=madalice 2026-09-04 22:16:28 L1=0.82 run=1 blk=0 avail=7571 (55.0%) swpO=0 conn=3 myRSS=3421 php=4 phpRSS=204 ap=14 tcp=21 topuser=madalice 2026-09-04 22:16:38 L1=0.85 run=2 blk=0 avail=7591 (55.1%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=205 ap=14 tcp=22 topuser=madalice 2026-09-04 22:16:38 L1=0.85 run=1 blk=0 avail=7591 (55.1%) swpO=0 conn=3 myRSS=3421 php=4 phpRSS=200 ap=14 tcp=22 topuser=madalice 2026-09-04 22:16:48 L1=0.88 run=2 blk=0 avail=7594 (55.1%) swpO=1 conn=2 myRSS=3421 php=4 phpRSS=205 ap=14 tcp=22 topuser=madalice 2026-09-04 22:16:48 L1=0.88 run=5 blk=0 avail=7590 (55.1%) swpO=1 conn=3 myRSS=3421 php=4 phpRSS=215 ap=14 tcp=23 topuser=madalice 2026-09-04 22:16:58 L1=0.90 run=2 blk=0 avail=7564 (54.9%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=205 ap=15 tcp=27 topuser=madalice 2026-09-04 22:16:58 L1=0.90 run=6 blk=0 avail=7564 (54.9%) swpO=0 conn=3 myRSS=3421 php=3 phpRSS=165 ap=17 tcp=28 topuser=madalice 2026-09-04 22:17:08 L1=1.36 run=3 blk=0 avail=7510 (54.5%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=229 ap=19 tcp=24 topuser=madalice 2026-09-04 22:17:08 L1=1.36 run=3 blk=0 avail=7538 (54.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=189 ap=19 tcp=24 topuser=madalice 2026-09-04 22:17:18 L1=1.22 run=1 blk=0 avail=7533 (54.7%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=228 ap=17 tcp=26 topuser=madalice 2026-09-04 22:17:18 L1=1.22 run=1 blk=0 avail=7546 (54.8%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=188 ap=17 tcp=26 topuser=madalice 2026-09-04 22:17:28 L1=1.19 run=1 blk=0 avail=7427 (53.9%) swpO=0 conn=2 myRSS=3421 php=5 phpRSS=350 ap=17 tcp=29 topuser=madalice 2026-09-04 22:17:28 L1=1.19 run=1 blk=0 avail=7440 (54.0%) swpO=0 conn=1 myRSS=3421 php=4 phpRSS=310 ap=17 tcp=29 topuser=madalice 2026-09-04 22:17:38 L1=1.00 run=6 blk=0 avail=6554 (47.6%) swpO=0 conn=2 myRSS=3421 php=5 phpRSS=448 ap=18 tcp=29 topuser=madalice 2026-09-04 22:17:38 L1=1.08 run=3 blk=0 avail=6543 (47.5%) swpO=117 conn=1 myRSS=3417 php=4 phpRSS=315 ap=18 tcp=29 topuser=madalice 2026-09-04 22:17:48 L1=1.08 run=4 blk=2 avail=4728 (34.3%) swpO=2399 conn=3 myRSS=3361 php=5 phpRSS=348 ap=18 tcp=25 topuser=madalice 2026-09-04 22:17:48 L1=1.39 run=4 blk=2 avail=4735 (34.4%) swpO=2391 conn=2 myRSS=3358 php=4 phpRSS=310 ap=18 tcp=27 topuser=madalice