INCIDENT 2026-09-10 01:39:34 trigger: php_rss=1530MB mysql_conn=15 ================================================================== load: 1.94 0.73 0.60 28/651 3462010 ncpu:10 mem_avail: 7429MB/13777MB (53.9%) swap_used:1434MB swapout:1098/s blocked(D):0 running:27 iowait:0.1% steal:0.0% php: 22 procs / 1530MB heaviest user: speedlin (17 procs, 1333MB) apache: 41 procs tcp_estab: 81 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2849 speedlin 17 1115 root 250 816 nobody 39 656 netdata 8 250 mailman 20 214 madalice 1 155 wp-toolkit 3 68 dovenull 6 66 dovecot 3 28 lowrange 2 26 kurri 2 26 cpanellogin 1 19 infinium 1 14 polkitd 1 13 mailnull 2 10 zabbix 1 8 nscd 1 6 named 1 6 evolution 6 6 --- php workers by user --- USER PROCS RSS_MB speedlin 17 1137 madalice 1 155 evolution 3 12 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6229 MB Active(file): 3652 MB Inactive(file): 2409 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 625 MB CommitLimit: 10984 MB Committed_AS: 9791 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 8-23:17:11 3184 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2917976 13.8 Ssl 1-20:54:08 /usr/sbin/mariadbd 166870 1 netdata 196360 2.7 Ssl 3-23:17:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3461413 167896 madalice 159180 12.1 S 00:44 php-fpm: pool madalice_com_au 2746767 2730373 root 158564 0.0 S 23:13:42 spamd child 3461937 3461928 speedlin 136024 43.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461949 3461459 speedlin 104808 68.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2730373 1 root 97028 0.0 Ss 23:16:47 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3152112 2730373 root 91656 0.0 S 01:30:52 spamd child 3461947 3460683 speedlin 89004 68.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461948 3461713 speedlin 87580 59.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461950 3461645 speedlin 86508 61.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461956 3460371 speedlin 83420 54.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461952 3461682 speedlin 82256 51.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461959 3461902 speedlin 78876 49.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461963 3461839 speedlin 78712 44.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461978 3461753 speedlin 63116 29.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461983 3461479 speedlin 60724 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461964 3461882 speedlin 58316 27.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461976 3461335 speedlin 57640 23.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461981 3461901 speedlin 54232 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461991 3461823 speedlin 54064 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461984 3461612 speedlin 52188 17.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3461997 3461743 speedlin 52080 15.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 48284 0.0 Sl 12-23:19:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3462042 3461935 speedlin 46536 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42028 0.0 Ss 49-22:58:23 cpsrvd (SSL) - waiting for connections 1469 1 root 41260 0.1 Ss 72-15:29:52 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2495258 1 wp-toolkit 39844 0.0 Ss 1-00:25:42 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3462051 1469 root 38660 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3462054 1469 root 38660 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 37192 0.1 Sl 3-23:17:12 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3462052 1469 root 35968 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3462057 1469 root 35884 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3118064 1 root 35732 0.0 Ss 01:39:34 lfd - sleeping 3462050 3461410 evolution 30856 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3462061 1469 root 28680 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2495169 1 wp-toolkit 27684 0.0 Ss 1-00:25:42 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3461954 1463 root 25856 6.0 S 00:01 tailwatchd - chkservd - pop check 3444450 506832 nobody 24604 0.0 S 05:58 /usr/sbin/httpd -k start 3460371 506832 nobody 23388 0.0 S 03:00 /usr/sbin/httpd -k start 3460683 506832 nobody 23292 0.0 S 02:24 /usr/sbin/httpd -k start 2495282 1 root 21568 0.1 Ssl 1-00:25:40 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 20972 0.0 Ss 72-15:29:52 tailwatchd 3461335 506832 nobody 20180 0.1 S 00:54 /usr/sbin/httpd -k start 3426444 1353308 cpanellogin 20160 0.0 S 13:07 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 2328754 1 root 19548 0.0 Ss 1-20:54:18 /usr/lib/systemd/systemd-journald 3461679 506832 nobody 19500 0.1 S 00:21 /usr/sbin/httpd -k start 3461902 506832 nobody 19108 0.5 S 00:04 /usr/sbin/httpd -k start 3461926 506832 nobody 19084 0.3 S 00:03 /usr/sbin/httpd -k start 3461459 506832 nobody 18944 0.0 S 00:41 /usr/sbin/httpd -k start 3461410 506832 nobody 18732 0.2 S 00:46 /usr/sbin/httpd -k start 3461612 506832 nobody 18720 0.0 S 00:29 /usr/sbin/httpd -k start 3461712 506832 nobody 18136 0.0 S 00:17 /usr/sbin/httpd -k start 3461899 506832 nobody 18128 0.2 S 00:04 /usr/sbin/httpd -k start 3461575 506832 nobody 17952 0.0 S 00:33 /usr/sbin/httpd -k start 3461649 506832 nobody 17860 0.4 S 00:22 /usr/sbin/httpd -k start 3461682 506832 nobody 17844 0.0 S 00:21 /usr/sbin/httpd -k start 3461901 506832 nobody 17772 0.2 S 00:04 /usr/sbin/httpd -k start 3461752 506832 nobody 17756 0.0 S 00:13 /usr/sbin/httpd -k start 3461479 506832 nobody 17724 0.0 S 00:38 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8005937 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kurri/kurrimotorinn.com.au-ssl_log 284 evolution/app.evolutionerp.com.au-ssl_log 167 speedlin/speedlinefencing.com.au-ssl_log 20 evolution/portal.evolutionerp.com.au-ssl_log 19 tubesupplies/tubesupplies.com.au-ssl_log 11 madalice/madalice.com.au-ssl_log 9 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 167 40.115.94.245 163 34.180.76.131 121 34.21.187.179 37 136.65.82.2 19 203.54.180.238 8 146.70.178.116 6 118.127.40.55 3 114.119.131.88 2 91.92.243.249 2 2a10:3c0:3:0:1:31:0:5 1 2a03:2880:f802:28:: 1 185.201.230.67 1 114.119.146.16 1 114.119.143.14 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 107 GET /api/getItem/LWPG2001KG 60 GET /api/getItem/LWFBW2001KG 19 GET /heartbeat.php 9 POST / 6 GET / 2 POST /wp-login.php 2 GET /wp-config.php.bak 2 GET /wp-config.php 2 GET /web/.env 2 GET /v2/.env 2 GET /v1/.env 2 GET /store/custom-newcastle-knights-kids/ 2 GET /store/custom-melbourne-storm-shoes-design2/ 2 GET /.ssh/id_rsa 2 GET /.ssh/id_ed25519 2 GET /.ssh/id_dsa 2 GET /src/.env 2 GET /server/.env 2 GET /public/.env 2 GET /private-key --- busiest 3 vhosts: top paths + last 10 requests --- == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 4 POST / 4 GET / 2 GET /web/.env 2 GET /v2/.env 2 GET /v1/.env 2 GET /src/.env 2 GET /server/.env 2 GET /public/.env 2 GET /laravel/.env 2 GET /.git/config 2 GET /@fs/proc/self/environ 2 GET /frontend/.env -- last 10 requests -- 34.21.187.179 - - [10/Sep/2026:01:39:35 +1000] "GET /client/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:35 +1000] "GET /project/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:35 +1000] "GET /admin-panel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:35 +1000] "GET /control-panel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:36 +1000] "GET /user-panel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:36 +1000] "GET /node/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:36 +1000] "GET /express/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:36 +1000] "GET /next/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:36 +1000] "GET /nuxt/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.21.187.179 - - [10/Sep/2026:01:39:36 +1000] "GET /nest/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 107 GET /api/getItem/LWPG2001KG 60 GET /api/getItem/LWFBW2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:01:39:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:01:39:31 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 5 POST / 1 GET /wp-config.txt 1 GET /wp-config.php.txt 1 GET /wp-config.php.swp 1 GET /.wp-config.php.swp 1 GET /wp-config.php.SAVE 1 GET /wp-config.php.save 1 GET /wp-config.php.original 1 GET /wp-config.php_orig 1 GET /wp-config.php.orig 1 GET /wp-config.php.inc 1 GET /wp-config.php.html -- last 10 requests -- 136.65.82.2 - - [10/Sep/2026:01:39:34 +1000] "GET /.ssh/id_rsa_2048 HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" 136.65.82.2 - - [10/Sep/2026:01:39:32 +1000] "GET /id_dsa HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27" 118.127.40.55 - - [10/Sep/2026:01:39:32 +1000] "POST /?wordfence_syncAttackData=1788968372.1586 HTTP/1.1" 200 15365 "-" "WordPress/7.1; https://speedlinefencing.com.au" 136.65.82.2 - - [10/Sep/2026:01:39:34 +1000] "GET /wp-config.php.bk HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" 136.65.82.2 - - [10/Sep/2026:01:39:32 +1000] "GET /ssl/speedlinefencing.com.au.key HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.4 Safari/6 136.65.82.2 - - [10/Sep/2026:01:39:30 +1000] "GET /.wp-config.php.swp HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.14" 136.65.82.2 - - [10/Sep/2026:01:39:32 +1000] "GET /id_rsa HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0" 118.127.40.55 - - [10/Sep/2026:01:39:32 +1000] "POST /?wordfence_syncAttackData=1788968372.1454 HTTP/1.1" 200 15365 "-" "WordPress/7.1; https://speedlinefencing.com.au" 118.127.40.55 - - [10/Sep/2026:01:39:32 +1000] "POST /?wordfence_syncAttackData=1788968372.2274 HTTP/1.1" 200 15363 "-" "WordPress/7.1; https://speedlinefencing.com.au" 136.65.82.2 - - [10/Sep/2026:01:39:34 +1000] "GET /private-key HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 01:37:08 L1=0.50 run=3 blk=0 avail=8446 (61.3%) swpO=1 conn=1 myRSS=2880 php=5 phpRSS=245 ap=17 tcp=28 topuser=madalice 2026-09-10 01:37:13 L1=0.46 run=1 blk=0 avail=8475 (61.5%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=157 ap=19 tcp=26 topuser=madalice 2026-09-10 01:37:18 L1=0.42 run=1 blk=0 avail=8478 (61.5%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=157 ap=19 tcp=23 topuser=madalice 2026-09-10 01:37:23 L1=0.39 run=1 blk=0 avail=8493 (61.6%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=157 ap=16 tcp=23 topuser=madalice 2026-09-10 01:37:29 L1=0.36 run=1 blk=0 avail=8491 (61.6%) swpO=0 conn=1 myRSS=2880 php=5 phpRSS=175 ap=16 tcp=24 topuser=madalice 2026-09-10 01:37:34 L1=0.33 run=1 blk=0 avail=8489 (61.6%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=158 ap=16 tcp=23 topuser=madalice 2026-09-10 01:37:39 L1=0.30 run=2 blk=0 avail=8485 (61.6%) swpO=0 conn=1 myRSS=2880 php=5 phpRSS=199 ap=15 tcp=23 topuser=madalice 2026-09-10 01:37:44 L1=0.28 run=1 blk=0 avail=8499 (61.7%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=158 ap=14 tcp=25 topuser=madalice 2026-09-10 01:37:49 L1=0.25 run=2 blk=0 avail=8485 (61.6%) swpO=0 conn=2 myRSS=2880 php=6 phpRSS=241 ap=14 tcp=23 topuser=madalice 2026-09-10 01:37:54 L1=0.31 run=1 blk=0 avail=8503 (61.7%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=158 ap=14 tcp=24 topuser=madalice 2026-09-10 01:37:59 L1=0.29 run=1 blk=0 avail=8490 (61.6%) swpO=0 conn=2 myRSS=2880 php=5 phpRSS=198 ap=14 tcp=22 topuser=madalice 2026-09-10 01:38:04 L1=0.27 run=4 blk=0 avail=8446 (61.3%) swpO=0 conn=1 myRSS=2880 php=5 phpRSS=241 ap=15 tcp=24 topuser=madalice 2026-09-10 01:38:09 L1=0.40 run=1 blk=0 avail=8490 (61.6%) swpO=1 conn=2 myRSS=2880 php=5 phpRSS=199 ap=15 tcp=22 topuser=madalice 2026-09-10 01:38:14 L1=0.42 run=1 blk=0 avail=8507 (61.8%) swpO=1 conn=1 myRSS=2880 php=4 phpRSS=158 ap=14 tcp=26 topuser=madalice 2026-09-10 01:38:19 L1=0.38 run=4 blk=0 avail=8485 (61.6%) swpO=0 conn=2 myRSS=2880 php=7 phpRSS=274 ap=14 tcp=26 topuser=madalice 2026-09-10 01:38:24 L1=0.35 run=2 blk=0 avail=8499 (61.7%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=157 ap=15 tcp=27 topuser=madalice 2026-09-10 01:38:29 L1=0.32 run=1 blk=0 avail=8480 (61.6%) swpO=0 conn=2 myRSS=2880 php=5 phpRSS=198 ap=15 tcp=26 topuser=madalice 2026-09-10 01:38:34 L1=0.30 run=2 blk=0 avail=8493 (61.6%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=157 ap=15 tcp=42 topuser=madalice 2026-09-10 01:38:39 L1=0.43 run=4 blk=0 avail=8336 (60.5%) swpO=0 conn=2 myRSS=2880 php=7 phpRSS=386 ap=17 tcp=25 topuser=madalice 2026-09-10 01:38:44 L1=0.40 run=1 blk=0 avail=8613 (62.5%) swpO=0 conn=1 myRSS=2880 php=3 phpRSS=2 ap=17 tcp=25 topuser=root 2026-09-10 01:38:49 L1=0.37 run=6 blk=0 avail=8573 (62.2%) swpO=0 conn=2 myRSS=2880 php=4 phpRSS=43 ap=14 tcp=38 topuser=evolution 2026-09-10 01:38:54 L1=0.34 run=1 blk=0 avail=8507 (61.7%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=134 ap=16 tcp=38 topuser=madalice 2026-09-10 01:38:59 L1=0.31 run=1 blk=0 avail=8476 (61.5%) swpO=0 conn=2 myRSS=2880 php=5 phpRSS=175 ap=18 tcp=24 topuser=madalice 2026-09-10 01:39:04 L1=0.36 run=2 blk=0 avail=8333 (60.5%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=134 ap=17 tcp=23 topuser=madalice 2026-09-10 01:39:09 L1=0.42 run=2 blk=0 avail=8438 (61.3%) swpO=0 conn=2 myRSS=2880 php=6 phpRSS=275 ap=16 tcp=24 topuser=madalice 2026-09-10 01:39:14 L1=0.38 run=1 blk=0 avail=8479 (61.5%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=157 ap=20 tcp=42 topuser=madalice 2026-09-10 01:39:19 L1=0.35 run=4 blk=0 avail=8444 (61.3%) swpO=0 conn=2 myRSS=2880 php=5 phpRSS=198 ap=22 tcp=27 topuser=madalice 2026-09-10 01:39:24 L1=0.40 run=1 blk=0 avail=8451 (61.3%) swpO=0 conn=1 myRSS=2880 php=4 phpRSS=157 ap=23 tcp=33 topuser=madalice 2026-09-10 01:39:29 L1=0.37 run=5 blk=0 avail=8414 (61.1%) swpO=0 conn=2 myRSS=2880 php=5 phpRSS=198 ap=26 tcp=51 topuser=madalice 2026-09-10 01:39:34 L1=1.94 run=27 blk=0 avail=7429 (53.9%) swpO=1098 conn=15 myRSS=2849 php=22 phpRSS=1530 ap=41 tcp=81 topuser=speedlin