INCIDENT 2026-09-06 21:59:22 trigger: php_rss=2280MB ================================================================== load: 3.18 2.71 2.33 9/704 4183523 ncpu:10 mem_avail: 7991MB/13777MB (58.0%) swap_used:2432MB swapout:86/s blocked(D):1 running:12 iowait:6.9% steal:0.0% php: 18 procs / 2280MB heaviest user: madalice (10 procs, 1837MB) apache: 36 procs tcp_estab: 63 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 11 1915 mysql 1 1512 root 251 939 nobody 35 601 evolution 13 246 netdata 8 236 speedlin 2 200 mailman 20 115 wp-toolkit 3 56 dovenull 6 55 cpanellogin 1 48 corpkicks 3 42 mailnull 3 40 kurri 3 38 lowrange 2 29 vinesit 2 28 dovecot 3 23 aaa 1 15 infinium 1 14 named 1 13 --- php workers by user --- USER PROCS RSS_MB madalice 10 1914 evolution 5 238 speedlin 2 201 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7438 MB Active(file): 3579 MB Inactive(file): 3898 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 531 MB CommitLimit: 10984 MB Committed_AS: 10276 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-19:36:57 5424 /usr/bin/imunify-agent-proxy 4109079 root 1-17:14:35 1752 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-17:14:35 67944 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1549300 3.0 Ssl 1-02:22:52 /usr/sbin/mariadbd 4183198 167896 madalice 252256 24.5 R 00:21 php-fpm: pool madalice_com_au 4183365 167896 madalice 249632 33.8 R 00:11 php-fpm: pool madalice_com_au 4183385 167896 madalice 244044 25.1 R 00:10 php-fpm: pool madalice_com_au 4183371 167896 madalice 228720 31.6 R 00:11 php-fpm: pool madalice_com_au 4183369 167896 madalice 216868 33.1 R 00:11 php-fpm: pool madalice_com_au 166870 1 netdata 177824 2.6 Ssl 19:37:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4183372 167896 madalice 172960 29.9 R 00:11 php-fpm: pool madalice_com_au 4183374 167896 madalice 159240 27.3 S 00:10 php-fpm: pool madalice_com_au 220207 168913 root 159176 0.0 S 19:21:05 spamd child 4183373 167896 madalice 159160 25.6 S 00:10 php-fpm: pool madalice_com_au 4183381 167896 madalice 159148 26.0 S 00:10 php-fpm: pool madalice_com_au 4183375 167896 madalice 158648 26.4 R 00:10 php-fpm: pool madalice_com_au 4183490 4181124 evolution 146348 59.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 167871 1 root 131576 0.0 Ss 19:36:56 /usr/lib/systemd/systemd-journald 4183483 4164233 speedlin 121988 43.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4183485 4183383 evolution 100128 16.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 168913 1 root 94916 0.0 Ss 19:35:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4183492 4183394 speedlin 89532 57.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4109105 4109079 root 67944 1.4 Sl 1-17:14:35 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 4131745 1353308 cpanellogin 49768 0.0 S 14:54 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2902970 168913 root 43208 0.0 S 06:17:48 spamd child 1353308 1 root 42072 0.1 Ss 46-19:18:09 cpsrvd (SSL) - waiting for connections 1469 1 root 41208 0.1 Ss 69-11:49:38 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4183493 1469 root 38568 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 38380 0.1 Sl 19:36:58 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34892 0.0 Sl 9-19:39:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31848 0.0 Ss 19:37:07 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 4182176 4182116 root 24984 0.0 S 02:00 /usr/sbin/exim -q 1463 1 root 24288 0.0 Ss 69-11:49:38 tailwatchd 167896 1 root 23932 0.0 Ss 19:36:55 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4166109 506832 nobody 22156 0.0 S 04:54 /usr/sbin/httpd -k start 4181276 506832 nobody 21848 0.1 S 03:18 /usr/sbin/httpd -k start 4164302 506832 nobody 21844 0.0 S 08:17 /usr/sbin/httpd -k start 4164233 506832 nobody 21680 0.0 S 08:18 /usr/sbin/httpd -k start 4166103 506832 nobody 21576 0.1 S 04:55 /usr/sbin/httpd -k start 4166113 506832 nobody 21372 0.0 S 04:54 /usr/sbin/httpd -k start 4131025 506832 nobody 21008 0.0 S 15:58 /usr/sbin/httpd -k start 4181124 506832 nobody 20772 0.1 S 03:31 /usr/sbin/httpd -k start 4166110 506832 nobody 20660 0.1 S 04:54 /usr/sbin/httpd -k start 4182179 4182176 mailnull 20392 0.0 S 02:00 /usr/sbin/exim -q 4181798 506832 nobody 20340 0.0 S 02:35 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19684 0.0 Ss 19:36:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 4166114 506832 nobody 19484 0.1 S 04:54 /usr/sbin/httpd -k start 4183432 506832 nobody 19464 0.2 S 00:08 /usr/sbin/httpd -k start 4182428 506832 nobody 19160 0.0 S 01:34 /usr/sbin/httpd -k start 4183104 506832 nobody 18704 0.1 S 00:26 /usr/sbin/httpd -k start 4183396 506832 nobody 18468 0.1 S 00:09 /usr/sbin/httpd -k start 4183397 506832 nobody 18404 0.1 S 00:09 /usr/sbin/httpd -k start 4183463 506832 nobody 18404 0.2 S 00:05 /usr/sbin/httpd -k start 4183370 506832 nobody 18360 0.0 S 00:11 /usr/sbin/httpd -k start 4183394 506832 nobody 18340 0.2 S 00:09 /usr/sbin/httpd -k start 4183383 506832 nobody 18332 0.1 S 00:10 /usr/sbin/httpd -k start 4183384 506832 nobody 18280 0.1 S 00:10 /usr/sbin/httpd -k start 167566 166914 netdata 17272 2.1 Sl 19:36:58 /usr/libexec/netdata/plugins.d/apps.plugin 1 4183209 506832 nobody 17144 0.0 S 00:21 /usr/sbin/httpd -k start 4183220 506832 nobody 16696 0.1 S 00:20 /usr/sbin/httpd -k start 4165876 1471 root 16588 0.0 S 05:18 cPhulkd - dbprocessor 4183430 506832 nobody 16492 0.1 S 00:08 /usr/sbin/httpd -k start 4183431 506832 nobody 16400 0.0 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+-------------+-------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+-------------+-------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 753278 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 753270 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE option_name IN ('_transient_ppcp-seller-status-seller_status','_transient_timeout_ppcp-seller-status-seller_status') | +--------+-------------+-------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min speedlin/speedlinefencing.com.au-ssl_log 155 evolution/app.evolutionerp.com.au-ssl_log 131 olympic/olympicfencing.com.au-ssl_log 25 evolution/evolutionerp.com.au-ssl_log 24 madalice/madalice.com.au-ssl_log 21 tubesupplies/tubesupplies.com.au 6 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 138 137.23.3.14 131 40.115.94.245 23 4.204.224.164 22 20.151.10.161 19 118.127.40.55 12 34.133.24.34 6 188.95.65.97 2 50.116.112.105 2 114.119.140.234 1 95.108.213.240 1 66.249.73.171 1 34.196.51.17 1 17.166.23.142 1 114.119.143.14 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 92 GET /wp-admin/index.php 66 GET /api/getItem/LWFBW2001KG 65 GET /api/getItem/LWHG2001KG 47 POST /wp-login.php 13 POST / 6 POST /wp-cron.php 4 GET /store/swarovski-crystal-am90/ 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /store/swarovski-crystal-nike-af1-snake/ 2 GET /robots.txt 2 GET /rithin.php 2 GET /acp.php 1 HEAD / 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /XGtTsAeF.php 1 GET /wp-the.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/endpoints/class-wp-rest-font-families-controller.php 1 GET /wp-includes/rest-api/endpoints/class-wp-rest-font-faces-controller.php --- busiest 3 vhosts: top paths + last 10 requests --- == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 92 GET /wp-admin/index.php 46 POST /wp-login.php 13 POST / 4 POST /wp-cron.php -- last 10 requests -- 137.23.3.14 - - [06/Sep/2026:21:59:04 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18954 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) 137.23.3.14 - - [06/Sep/2026:21:59:05 +1000] "POST /wp-login.php HTTP/1.1" 503 18041 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko 137.23.3.14 - - [06/Sep/2026:21:59:06 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18954 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Ge 137.23.3.14 - - [06/Sep/2026:21:59:07 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18954 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Ge 137.23.3.14 - - [06/Sep/2026:21:59:08 +1000] "POST /wp-login.php HTTP/1.1" 503 18041 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0" 137.23.3.14 - - [06/Sep/2026:21:59:08 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18954 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 137.23.3.14 - - [06/Sep/2026:21:59:09 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18954 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 137.23.3.14 - - [06/Sep/2026:21:59:10 +1000] "POST /wp-login.php HTTP/1.1" 503 18041 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 137.23.3.14 - - [06/Sep/2026:21:59:11 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18954 "https://speedlinefencing.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C 118.127.40.55 - - [06/Sep/2026:21:59:12 +1000] "POST /?wordfence_syncAttackData=1788695952.3685 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://speedlinefencing.com.au" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 66 GET /api/getItem/LWFBW2001KG 65 GET /api/getItem/LWHG2001KG -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:21:59:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:21:59:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 1 POST /wp-login.php 1 POST /wp-cron.php 1 GET /XGtTsAeF.php 1 GET /wp-login.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-admin/images/advanced.php 1 GET /this_is_a_new_hello_world.php 1 GET /robots.php 1 GET /red.php 1 GET /k.php 1 GET /images/zerox.php -- last 10 requests -- 20.151.10.161 - - [06/Sep/2026:21:59:13 +1000] "GET /ccc.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:14 +1000] "GET /images.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:14 +1000] "GET /alls.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:15 +1000] "GET /red.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:15 +1000] "GET /admin.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:16 +1000] "GET /file52.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:16 +1000] "GET /geck.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:17 +1000] "GET /biufile.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:17 +1000] "GET /dejavu.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [06/Sep/2026:21:59:17 +1000] "GET /aaf.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-06 21:56:54 L1=3.19 run=5 blk=1 avail=9891 (71.8%) swpO=0 conn=3 myRSS=1514 php=7 phpRSS=326 ap=15 tcp=28 topuser=madalice 2026-09-06 21:57:01 L1=3.23 run=6 blk=2 avail=9837 (71.4%) swpO=34 conn=4 myRSS=1513 php=7 phpRSS=373 ap=15 tcp=30 topuser=madalice 2026-09-06 21:57:04 L1=3.23 run=3 blk=1 avail=9832 (71.4%) swpO=34 conn=3 myRSS=1513 php=7 phpRSS=371 ap=15 tcp=29 topuser=madalice 2026-09-06 21:57:11 L1=3.12 run=3 blk=1 avail=9831 (71.4%) swpO=0 conn=4 myRSS=1514 php=7 phpRSS=377 ap=15 tcp=30 topuser=speedlin 2026-09-06 21:57:14 L1=3.12 run=2 blk=1 avail=9905 (71.9%) swpO=0 conn=3 myRSS=1514 php=6 phpRSS=268 ap=15 tcp=30 topuser=madalice 2026-09-06 21:57:21 L1=3.02 run=2 blk=1 avail=9956 (72.3%) swpO=0 conn=4 myRSS=1514 php=6 phpRSS=222 ap=15 tcp=27 topuser=madalice 2026-09-06 21:57:24 L1=3.02 run=2 blk=1 avail=9897 (71.8%) swpO=0 conn=3 myRSS=1514 php=6 phpRSS=259 ap=15 tcp=28 topuser=madalice 2026-09-06 21:57:32 L1=2.94 run=3 blk=1 avail=9938 (72.1%) swpO=0 conn=4 myRSS=1514 php=6 phpRSS=222 ap=15 tcp=27 topuser=madalice 2026-09-06 21:57:34 L1=2.94 run=6 blk=1 avail=9719 (70.5%) swpO=0 conn=3 myRSS=1514 php=7 phpRSS=422 ap=15 tcp=33 topuser=madalice 2026-09-06 21:57:42 L1=2.79 run=2 blk=1 avail=9810 (71.2%) swpO=0 conn=4 myRSS=1514 php=6 phpRSS=258 ap=15 tcp=30 topuser=madalice 2026-09-06 21:57:44 L1=2.79 run=3 blk=1 avail=9851 (71.5%) swpO=0 conn=1 myRSS=1514 php=6 phpRSS=222 ap=15 tcp=30 topuser=madalice 2026-09-06 21:57:52 L1=2.75 run=3 blk=1 avail=9811 (71.2%) swpO=0 conn=4 myRSS=1514 php=7 phpRSS=284 ap=16 tcp=34 topuser=madalice 2026-09-06 21:57:55 L1=2.75 run=2 blk=1 avail=9775 (71.0%) swpO=0 conn=1 myRSS=1514 php=6 phpRSS=284 ap=16 tcp=32 topuser=madalice 2026-09-06 21:58:02 L1=2.72 run=3 blk=1 avail=9756 (70.8%) swpO=0 conn=3 myRSS=1514 php=7 phpRSS=341 ap=16 tcp=36 topuser=madalice 2026-09-06 21:58:05 L1=2.72 run=3 blk=1 avail=9832 (71.4%) swpO=0 conn=1 myRSS=1514 php=6 phpRSS=233 ap=16 tcp=33 topuser=madalice 2026-09-06 21:58:12 L1=2.76 run=5 blk=1 avail=9647 (70.0%) swpO=0 conn=3 myRSS=1514 php=7 phpRSS=285 ap=16 tcp=34 topuser=madalice 2026-09-06 21:58:15 L1=2.76 run=3 blk=1 avail=9651 (70.1%) swpO=0 conn=1 myRSS=1514 php=7 phpRSS=445 ap=16 tcp=32 topuser=madalice 2026-09-06 21:58:22 L1=2.80 run=9 blk=1 avail=9841 (71.4%) swpO=0 conn=3 myRSS=1514 php=7 phpRSS=273 ap=16 tcp=35 topuser=madalice 2026-09-06 21:58:25 L1=2.80 run=3 blk=1 avail=9718 (70.5%) swpO=0 conn=1 myRSS=1514 php=7 phpRSS=387 ap=16 tcp=32 topuser=madalice 2026-09-06 21:58:32 L1=2.68 run=5 blk=1 avail=9556 (69.4%) swpO=0 conn=3 myRSS=1514 php=8 phpRSS=570 ap=16 tcp=37 topuser=speedlin 2026-09-06 21:58:35 L1=2.68 run=2 blk=1 avail=9762 (70.9%) swpO=0 conn=1 myRSS=1514 php=6 phpRSS=285 ap=16 tcp=33 topuser=madalice 2026-09-06 21:58:42 L1=2.89 run=2 blk=1 avail=9889 (71.8%) swpO=0 conn=3 myRSS=1514 php=6 phpRSS=218 ap=16 tcp=32 topuser=madalice 2026-09-06 21:58:45 L1=2.89 run=4 blk=1 avail=9843 (71.4%) swpO=0 conn=3 myRSS=1514 php=7 phpRSS=301 ap=16 tcp=32 topuser=madalice 2026-09-06 21:58:52 L1=2.75 run=5 blk=1 avail=9657 (70.1%) swpO=0 conn=3 myRSS=1514 php=8 phpRSS=506 ap=16 tcp=34 topuser=speedlin 2026-09-06 21:58:55 L1=2.75 run=5 blk=1 avail=9580 (69.5%) swpO=0 conn=3 myRSS=1514 php=8 phpRSS=512 ap=16 tcp=39 topuser=infinium 2026-09-06 21:59:02 L1=2.86 run=3 blk=1 avail=9740 (70.7%) swpO=0 conn=5 myRSS=1514 php=7 phpRSS=403 ap=17 tcp=46 topuser=speedlin 2026-09-06 21:59:05 L1=2.86 run=5 blk=1 avail=9612 (69.8%) swpO=6 conn=3 myRSS=1514 php=8 phpRSS=533 ap=20 tcp=42 topuser=corpkicks 2026-09-06 21:59:12 L1=2.95 run=4 blk=1 avail=9631 (69.9%) swpO=6 conn=5 myRSS=1514 php=8 phpRSS=508 ap=20 tcp=43 topuser=evolution 2026-09-06 21:59:15 L1=2.95 run=7 blk=1 avail=8744 (63.5%) swpO=77 conn=3 myRSS=1512 php=15 phpRSS=1470 ap=27 tcp=58 topuser=madalice 2026-09-06 21:59:22 L1=3.18 run=12 blk=1 avail=7991 (58.0%) swpO=86 conn=11 myRSS=1512 php=18 phpRSS=2280 ap=36 tcp=63 topuser=madalice