INCIDENT 2026-09-04 22:18:59 trigger: swapout=3335/s ================================================================== load: 3.80 1.46 0.93 13/710 2784288 ncpu:10 mem_avail: 6110MB/13777MB (44.3%) swap_used:1870MB swapout:3335/s blocked(D):0 running:15 iowait:15.3% steal:0.0% php: 13 procs / 1379MB heaviest user: tubesupplies (10 procs, 1195MB) apache: 50 procs tcp_estab: 107 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3272 root 246 1032 tubesupplies 7 895 evolution 12 781 nobody 49 759 netdata 8 241 madalice 1 156 dovenull 6 67 cpanellogin 1 57 wp-toolkit 3 52 kurri 2 28 dovecot 3 28 mailman 20 25 vinesit 1 14 lowrange 1 14 zabbix 1 11 mailnull 2 10 polkitd 1 7 named 1 4 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB tubesupplies 7 901 madalice 1 156 root 1 27 evolution 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4083 MB Active(file): 980 MB Inactive(file): 2538 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 523 MB CommitLimit: 10984 MB Committed_AS: 9320 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2781800 root 03:03 53788 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 3-19:56:32 4068 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3350632 13.3 Ssl 2-08:04:47 /usr/sbin/mariadbd 2784119 2784118 evolution 767832 52.0 RNs 00:12 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 1043892 2603077 root 198076 0.1 S 08:14:03 spamd child 1542443 1 netdata 175480 2.6 Ssl 1-19:56:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2784130 2601907 madalice 160276 24.0 S 00:11 php-fpm: pool madalice_com_au 2784247 2784182 tubesupplies 151652 71.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2784246 2784188 tubesupplies 148284 68.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 143352 0.0 Ss 7-19:59:18 /usr/lib/systemd/systemd-journald 2784252 2766709 tubesupplies 138024 61.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2603077 1 root 135328 0.0 Ss 19:54:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2784254 2766708 tubesupplies 134552 61.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2784249 2766698 tubesupplies 129712 57.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2654376 2603077 root 115508 0.0 S 19:39:52 spamd child 2784253 2749443 tubesupplies 108384 44.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2507165 1353308 cpanellogin 58608 0.0 S 01:19:47 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2781800 1 root 53788 0.7 Ssl 03:03 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 42392 0.0 Sl 7-19:59:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40300 0.1 Ss 44-19:37:44 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 40176 0.1 Sl 1-19:56:33 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 38748 0.1 Ss 67-12:09:13 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 28672 0.0 Ss 1-19:56:37 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28616 0.0 Ss 19:55:33 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2602226 1 root 24524 0.1 Ssl 19:55:18 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 22824 0.0 Ss 67-12:09:13 tailwatchd 2782728 506832 nobody 22408 0.0 S 02:01 /usr/sbin/httpd -k start 2782726 506832 nobody 20720 0.0 S 02:01 /usr/sbin/httpd -k start 2782597 506832 nobody 19560 0.0 S 02:02 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 18976 0.0 Ss 1-19:56:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2784094 506832 nobody 18872 0.0 S 00:19 /usr/sbin/httpd -k start 2783815 506832 nobody 18280 0.0 S 00:49 /usr/sbin/httpd -k start 2782729 506832 nobody 18268 0.0 S 02:01 /usr/sbin/httpd -k start 1542982 1542551 netdata 18156 2.1 Sl 1-19:56:33 /usr/libexec/netdata/plugins.d/apps.plugin 1 2784189 506832 nobody 18084 0.0 S 00:07 /usr/sbin/httpd -k start 2783824 506832 nobody 17304 0.1 S 00:48 /usr/sbin/httpd -k start 2784176 506832 nobody 17140 0.0 S 00:10 /usr/sbin/httpd -k start 2784204 506832 nobody 17136 0.1 S 00:06 /usr/sbin/httpd -k start 2784182 506832 nobody 17096 0.0 S 00:09 /usr/sbin/httpd -k start 2784202 506832 nobody 17076 0.1 S 00:06 /usr/sbin/httpd -k start 2784183 506832 nobody 17064 0.0 S 00:09 /usr/sbin/httpd -k start 2782537 506832 nobody 17036 0.0 S 02:03 /usr/sbin/httpd -k start 2784219 506832 nobody 17020 0.2 S 00:05 /usr/sbin/httpd -k start 2784199 506832 nobody 17012 0.0 S 00:06 /usr/sbin/httpd -k start 2784198 506832 nobody 16992 0.1 S 00:06 /usr/sbin/httpd -k start 2784220 506832 nobody 16992 0.2 S 00:05 /usr/sbin/httpd -k start 1542141 1 root 16968 0.0 Ss 1-19:56:40 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 2784218 506832 nobody 16960 0.0 S 00:05 /usr/sbin/httpd -k start 2784216 506832 nobody 16932 0.2 S 00:05 /usr/sbin/httpd -k start 2784197 506832 nobody 16804 0.0 S 00:06 /usr/sbin/httpd -k start 2784200 506832 nobody 16800 0.1 S 00:06 /usr/sbin/httpd -k start 2784190 506832 nobody 16772 0.0 S 00:07 /usr/sbin/httpd -k start 2784187 506832 nobody 16768 0.1 S 00:07 /usr/sbin/httpd -k start 2784201 506832 nobody 16696 0.0 S 00:06 /usr/sbin/httpd -k start 2784203 506832 nobody 16696 0.0 S 00:06 /usr/sbin/httpd -k start 2784188 506832 nobody 16664 0.0 S 00:07 /usr/sbin/httpd -k start 690513 508511 root 16460 0.0 S 09:46:09 dovecot/config 2766661 506832 nobody 16124 0.0 S 04:59 /usr/sbin/httpd -k start 2766709 506832 nobody 15912 0.0 S 04:57 /usr/sbin/httpd -k start 2766698 506832 nobody 15752 0.0 S 04:58 /usr/sbin/httpd -k start 2748829 508511 kurri 15344 0.0 S 10:48 dovecot/imap 2749443 506832 nobody 15120 0.0 S 09:48 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10512805 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 238 evolution/app.evolutionerp.com.au-ssl_log 34 speedlin/speedlinefencing.com.au-ssl_log 23 coscom/coscom.com.au 18 kamcool/kamcool.com.au 18 nrg/nrgservices.net.au-ssl_log 18 evolution/portal.evolutionerp.com.au-ssl_log 10 madalice/madalice.com.au-ssl_log 10 alison/alisonarts.com.au-ssl_log 9 tubesupplies/tubesupplies.com.au-ssl_log 5 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 233 34.17.32.127 36 185.104.184.228 34 40.115.94.245 22 4.204.224.164 10 203.54.180.238 8 45.148.10.247 5 118.127.40.55 3 93.123.109.228 3 2001:4479:a007:8000:140:78d5:f71b:d9c3 2 91.92.243.249 2 91.92.243.248 2 212.95.151.62 2 114.119.131.88 1 89.184.61.196 1 89.146.68.38 --- top request paths across all vhosts (last 3 min) --- 11 GET / 10 GET /heartbeat.php 6 POST / 5 GET /store/crease-guards/ 4 POST /wp-login.php 4 POST /wp-cron.php 2 POST /wp/index.php 2 POST /wordpress/index.php 2 GET /xmlrpc.php 2 GET /wp/wp-includes/wlwmanifest.xml 2 GET /wp-includes/wlwmanifest.xml 2 GET /wp2/wp-includes/wlwmanifest.xml 2 GET /wp1/wp-includes/wlwmanifest.xml 2 GET /wordpress/wp-includes/wlwmanifest.xml 2 GET /web/wp-includes/wlwmanifest.xml 2 GET /website/wp-includes/wlwmanifest.xml 2 GET /test/wp-includes/wlwmanifest.xml 2 GET /shop/wp-includes/wlwmanifest.xml 2 GET /news/wp-includes/wlwmanifest.xml 2 GET /media/wp-includes/wlwmanifest.xml --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 4 POST / 3 POST /wp-cron.php 2 GET / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env -- last 10 requests -- 34.17.32.127 - - [04/Sep/2026:22:18:42 +1000] "GET /old/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:18:43 +1000] "GET /tmp/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 212.95.151.62 - - [04/Sep/2026:22:18:41 +1000] "GET /?option=com_content&task=view&id=96&Itemid=2 HTTP/1.1" 200 97118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128 34.17.32.127 - - [04/Sep/2026:22:18:43 +1000] "GET /public/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:18:43 +1000] "GET /info HTTP/1.1" 404 73274 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:18:45 +1000] "GET /php-info.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:18:46 +1000] "GET /phpversion.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:18:46 +1000] "GET /_phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:18:46 +1000] "GET /old_phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.32.127 - - [04/Sep/2026:22:18:47 +1000] "GET /server-info.php HTTP/1.1" 404 73285 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 1 GET /api/getItem/SHSG505050 1 GET /api/getItem/SHSG505040 1 GET /api/getItem/SHSG505030 1 GET /api/getItem/SHSG505025 1 GET /api/getItem/SHSG505020 1 GET /api/getItem/SHSG505016 1 GET /api/getItem/SHSG404030 1 GET /api/getItem/SHSG404025 1 GET /api/getItem/SHSG404016 1 GET /api/getItem/PXLG50 -- last 10 requests -- 40.115.94.245 - - [04/Sep/2026:22:18:12 +1000] "GET /api/getItem/SHSG505016 HTTP/1.1" 200 1549 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:13 +1000] "GET /api/getItem/SHSG505020 HTTP/1.1" 200 1601 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:13 +1000] "GET /api/getItem/SHSG505025 HTTP/1.1" 200 1593 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:13 +1000] "GET /api/getItem/SHSG505030 HTTP/1.1" 200 1534 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:14 +1000] "GET /api/getItem/SHSG505040 HTTP/1.1" 200 1536 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:14 +1000] "GET /api/getItem/SHSG505050 HTTP/1.1" 200 1530 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:15 +1000] "GET /api/getItem/SHSG656516 HTTP/1.1" 200 1591 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:15 +1000] "GET /api/getItem/SHSG656520 HTTP/1.1" 200 1595 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:15 +1000] "GET /api/getItem/SHSG656516 HTTP/1.1" 200 1591 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:18:16 +1000] "GET /api/getItem/SHSG656520 HTTP/1.1" 200 1595 "-" "RestSharp/106.13.0.0" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 1 GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /simple.php 1 GET /radio.php 1 GET /ops.php 1 GET /media.php 1 GET /mac.php 1 GET /k.php 1 GET /images.php 1 GET /images2.php 1 GET /fling.php -- last 10 requests -- 4.204.224.164 - - [04/Sep/2026:22:17:34 +1000] "GET /k.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:35 +1000] "GET /dex.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:35 +1000] "GET /222.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:36 +1000] "GET /chosen.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:36 +1000] "GET /1.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:36 +1000] "GET /fling.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:37 +1000] "GET /radio.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:37 +1000] "GET /mac.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [04/Sep/2026:22:17:38 +1000] "GET /simple.php HTTP/1.1" 401 36 "-" "-" 17.166.237.91 - - [04/Sep/2026:22:17:35 +1000] "GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema HTTP/1.1" 200 221 "https://speedlinefencing.com.au/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Apple --- last 30 samples (run-up to this incident) --- 2026-09-04 22:16:28 L1=0.82 run=1 blk=0 avail=7571 (55.0%) swpO=0 conn=3 myRSS=3421 php=4 phpRSS=204 ap=14 tcp=21 topuser=madalice 2026-09-04 22:16:38 L1=0.85 run=2 blk=0 avail=7591 (55.1%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=205 ap=14 tcp=22 topuser=madalice 2026-09-04 22:16:38 L1=0.85 run=1 blk=0 avail=7591 (55.1%) swpO=0 conn=3 myRSS=3421 php=4 phpRSS=200 ap=14 tcp=22 topuser=madalice 2026-09-04 22:16:48 L1=0.88 run=2 blk=0 avail=7594 (55.1%) swpO=1 conn=2 myRSS=3421 php=4 phpRSS=205 ap=14 tcp=22 topuser=madalice 2026-09-04 22:16:48 L1=0.88 run=5 blk=0 avail=7590 (55.1%) swpO=1 conn=3 myRSS=3421 php=4 phpRSS=215 ap=14 tcp=23 topuser=madalice 2026-09-04 22:16:58 L1=0.90 run=2 blk=0 avail=7564 (54.9%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=205 ap=15 tcp=27 topuser=madalice 2026-09-04 22:16:58 L1=0.90 run=6 blk=0 avail=7564 (54.9%) swpO=0 conn=3 myRSS=3421 php=3 phpRSS=165 ap=17 tcp=28 topuser=madalice 2026-09-04 22:17:08 L1=1.36 run=3 blk=0 avail=7510 (54.5%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=229 ap=19 tcp=24 topuser=madalice 2026-09-04 22:17:08 L1=1.36 run=3 blk=0 avail=7538 (54.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=189 ap=19 tcp=24 topuser=madalice 2026-09-04 22:17:18 L1=1.22 run=1 blk=0 avail=7533 (54.7%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=228 ap=17 tcp=26 topuser=madalice 2026-09-04 22:17:18 L1=1.22 run=1 blk=0 avail=7546 (54.8%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=188 ap=17 tcp=26 topuser=madalice 2026-09-04 22:17:28 L1=1.19 run=1 blk=0 avail=7427 (53.9%) swpO=0 conn=2 myRSS=3421 php=5 phpRSS=350 ap=17 tcp=29 topuser=madalice 2026-09-04 22:17:28 L1=1.19 run=1 blk=0 avail=7440 (54.0%) swpO=0 conn=1 myRSS=3421 php=4 phpRSS=310 ap=17 tcp=29 topuser=madalice 2026-09-04 22:17:38 L1=1.00 run=6 blk=0 avail=6554 (47.6%) swpO=0 conn=2 myRSS=3421 php=5 phpRSS=448 ap=18 tcp=29 topuser=madalice 2026-09-04 22:17:38 L1=1.08 run=3 blk=0 avail=6543 (47.5%) swpO=117 conn=1 myRSS=3417 php=4 phpRSS=315 ap=18 tcp=29 topuser=madalice 2026-09-04 22:17:48 L1=1.08 run=4 blk=2 avail=4728 (34.3%) swpO=2399 conn=3 myRSS=3361 php=5 phpRSS=348 ap=18 tcp=25 topuser=madalice 2026-09-04 22:17:48 L1=1.39 run=4 blk=2 avail=4735 (34.4%) swpO=2391 conn=2 myRSS=3358 php=4 phpRSS=310 ap=18 tcp=27 topuser=madalice 2026-09-04 22:17:58 L1=1.48 run=2 blk=0 avail=4811 (34.9%) swpO=1061 conn=2 myRSS=3334 php=3 phpRSS=186 ap=18 tcp=28 topuser=madalice 2026-09-04 22:17:59 L1=1.48 run=2 blk=0 avail=4823 (35.0%) swpO=1063 conn=1 myRSS=3334 php=3 phpRSS=186 ap=18 tcp=26 topuser=madalice 2026-09-04 22:18:08 L1=1.78 run=4 blk=0 avail=4437 (32.2%) swpO=1175 conn=2 myRSS=3309 php=4 phpRSS=214 ap=18 tcp=29 topuser=madalice 2026-09-04 22:18:09 L1=1.78 run=3 blk=1 avail=4469 (32.4%) swpO=1175 conn=1 myRSS=3309 php=4 phpRSS=300 ap=18 tcp=30 topuser=madalice 2026-09-04 22:18:18 L1=1.81 run=2 blk=0 avail=7073 (51.3%) swpO=693 conn=2 myRSS=3295 php=3 phpRSS=188 ap=21 tcp=27 topuser=madalice 2026-09-04 22:18:19 L1=1.81 run=7 blk=0 avail=6879 (49.9%) swpO=693 conn=1 myRSS=3295 php=6 phpRSS=384 ap=21 tcp=27 topuser=aaa 2026-09-04 22:18:29 L1=1.76 run=2 blk=0 avail=7447 (54.1%) swpO=0 conn=2 myRSS=3295 php=3 phpRSS=188 ap=18 tcp=28 topuser=madalice 2026-09-04 22:18:29 L1=1.76 run=2 blk=0 avail=7236 (52.5%) swpO=0 conn=1 myRSS=3295 php=4 phpRSS=204 ap=18 tcp=27 topuser=madalice 2026-09-04 22:18:39 L1=1.73 run=2 blk=0 avail=6478 (47.0%) swpO=0 conn=2 myRSS=3295 php=3 phpRSS=188 ap=18 tcp=30 topuser=madalice 2026-09-04 22:18:40 L1=1.73 run=5 blk=0 avail=6358 (46.2%) swpO=0 conn=1 myRSS=3295 php=6 phpRSS=361 ap=18 tcp=31 topuser=madalice 2026-09-04 22:18:49 L1=1.61 run=2 blk=0 avail=7705 (55.9%) swpO=0 conn=2 myRSS=3295 php=3 phpRSS=49 ap=18 tcp=28 topuser=root 2026-09-04 22:18:50 L1=1.61 run=7 blk=0 avail=7128 (51.7%) swpO=0 conn=1 myRSS=3295 php=7 phpRSS=549 ap=18 tcp=56 topuser=customc 2026-09-04 22:18:59 L1=3.80 run=15 blk=0 avail=6110 (44.3%) swpO=3335 conn=9 myRSS=3272 php=13 phpRSS=1379 ap=50 tcp=107 topuser=tubesupplies