INCIDENT 2026-08-13 02:38:43 trigger: php_rss=1686MB ================================================================== load: 1.89 0.80 0.81 17/598 391341 ncpu:10 mem_avail: 6470MB/11729MB (55.2%) swap_used:945MB swapout:26/s blocked(D):0 running:19 iowait:0.1% steal:0.0% php: 12 procs / 1686MB heaviest user: evolution (12 procs, 1686MB) apache: 20 procs tcp_estab: 53 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1662 evolution 15 1329 root 238 901 nobody 19 296 netdata 8 274 cpanellogin 1 49 lowrange 3 37 mailman 20 30 dovenull 6 26 aaa 2 25 wp-toolkit 6 22 mailnull 2 22 zabbix 1 15 kurri 1 11 infinium 1 11 dovecot 3 9 named 1 7 nscd 1 3 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB evolution 10 1192 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5445 MB Active(file): 4426 MB Inactive(file): 1413 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 580 MB CommitLimit: 9960 MB Committed_AS: 7420 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 01:27:26 9524 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1702632 3.6 Ssl 06:05:11 /usr/sbin/mariadbd 1220 1 netdata 222192 2.5 Ssl 44-16:28:44 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 391296 390153 evolution 180672 100 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 391297 391129 evolution 178680 95.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 391300 391205 evolution 175272 83.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 382990 1 root 175004 0.4 Ss 15:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 388651 382990 root 168988 0.0 S 04:44 spamd child 388652 382990 root 167260 0.0 S 04:44 spamd child 391294 390438 evolution 148052 70.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 391307 390770 evolution 143788 67.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 391302 391211 evolution 143620 69.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 391295 390769 evolution 123160 52.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 391308 391204 evolution 107340 41.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 159820 1 root 106460 0.0 Ss 23-16:51:52 /usr/lib/systemd/systemd-journald 391335 391309 evolution 65328 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 391336 391310 evolution 65184 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 380279 1353308 cpanellogin 50468 0.0 S 20:13 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1353308 1 root 42188 0.0 Ss 21-23:57:14 cpsrvd (SSL) - waiting for connections 2223 1201 root 39856 0.0 Sl 44-16:28:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 39420 0.1 Sl 44-16:28:39 /usr/libexec/netdata/plugins.d/go.d.plugin 1 382254 1 root 33620 0.0 Ss 16:30 lfd - sleeping 388990 388942 root 23500 0.0 S 04:17 /usr/sbin/exim -q 389979 1276780 nobody 21688 0.0 S 02:47 /usr/sbin/httpd -k start 389413 1276780 nobody 21084 0.0 S 03:41 /usr/sbin/httpd -k start 389227 1276780 nobody 20620 0.0 S 03:46 /usr/sbin/httpd -k start 388992 388990 mailnull 20568 0.0 S 04:17 /usr/sbin/exim -q 390763 1276780 nobody 20016 0.0 S 01:18 /usr/sbin/httpd -k start 390438 1276780 nobody 19380 0.0 S 01:59 /usr/sbin/httpd -k start 390153 1276780 nobody 18536 0.0 S 02:34 /usr/sbin/httpd -k start 390769 1276780 nobody 18484 0.0 S 01:16 /usr/sbin/httpd -k start 391211 1276780 nobody 18324 0.0 S 00:12 /usr/sbin/httpd -k start 185104 2431 netdata 17588 1.9 Rl 06:05:02 /usr/libexec/netdata/plugins.d/apps.plugin 1 391204 1276780 nobody 17524 0.1 S 00:13 /usr/sbin/httpd -k start 1469 1 root 17380 0.1 Ss 44-16:28:43 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 391129 1276780 nobody 16564 0.0 S 00:24 /usr/sbin/httpd -k start 390770 1276780 nobody 16376 0.0 S 01:16 /usr/sbin/httpd -k start 1204 1 zabbix 16236 0.2 Ssl 44-16:28:44 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 391200 1276780 nobody 15548 0.0 S 00:14 /usr/sbin/httpd -k start 391205 1276780 nobody 15548 0.1 S 00:13 /usr/sbin/httpd -k start 391210 1276780 nobody 15520 0.0 S 00:12 /usr/sbin/httpd -k start 391292 1276780 nobody 15148 0.0 S 00:01 /usr/sbin/httpd -k start 391309 1276780 nobody 14664 0.0 S 00:00 /usr/sbin/httpd -k start 391310 1276780 nobody 14664 0.0 S 00:00 /usr/sbin/httpd -k start 1463 1 root 14360 0.0 Ss 44-16:28:43 tailwatchd 374784 3828812 aaa 13480 0.0 S 29:46 dovecot/imap 367498 3828812 lowrange 12988 0.0 S 43:15 dovecot/imap 391284 3828812 lowrange 12956 0.6 S 00:06 dovecot/pop3 273730 3828812 lowrange 12772 0.0 S 03:30:17 dovecot/imap 391280 3828812 aaa 12476 0.5 S 00:08 dovecot/imap 347756 3828812 infinium 12148 0.0 S 01:18:53 dovecot/imap 383627 3828812 kurri 11784 0.0 S 15:15 dovecot/imap 388942 281734 root 11692 0.0 S 04:21 /usr/sbin/exim -q 391281 3828812 root 11064 0.1 S 00:08 dovecot/auth -w 391254 1471 root 10376 0.0 S 00:08 cPhulkd - processor - http socket 837413 1471 root 10084 0.0 S 3-07:29:52 cPhulkd - dbprocessor 342014 1 root 9524 0.0 Ssl 01:27:26 /usr/bin/imunify-agent-proxy 1805633 3828812 dovenull 8892 0.0 S 2-11:05:50 dovecot/imap-login 3651102 1 root 7968 0.0 Ss 5-00:15:57 queueprocd - waiting up to 60s to process a task 2536732 1 named 7860 0.0 Ssl 41-00:16:31 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1805629 3828812 dovenull 7856 0.0 S 2-11:05:50 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 109660 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au-ssl_log 103 evolution/evolutionerp.com.au-ssl_log 52 infinium/infinium.net.au-ssl_log 41 evolution/portal.evolutionerp.com.au-ssl_log 29 corpkicks/corporatekicks.com.au-ssl_log 8 madalice/madalice.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 103 35.195.83.253 51 136.85.33.248 29 203.54.180.238 13 118.127.40.55 4 66.116.199.98 3 49.177.59.195 3 203.56.244.114 2 50.6.6.8 2 50.6.231.19 2 216.73.217.37 2 209.42.21.221 2 192.185.83.225 2 185.6.9.128 2 167.99.71.20 2 157.230.98.178 --- top request paths across all vhosts (last 3 min) --- 48 GET /cgi-sys/suspendedpage.cgi 29 GET /heartbeat.php 14 GET /wp-login.php 13 POST /wp-login.php 8 POST /wp-cron.php 7 GET / 5 POST / 3 GET /wp-json/wp/v2/users/me 3 GET /store/kids-swarovski-blinged-diamond-kicks/ 1 HEAD / 1 GET /web.config 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /terraform.tfvars 1 GET /terraform.tfstate 1 GET /telescope/requests 1 GET /.svn/entries 1 GET /.streamlit/secrets.toml 1 GET /ssl/server.key 1 GET /ssl/localhost.key --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 48 GET /cgi-sys/suspendedpage.cgi 1 GET /web.config 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /terraform.tfvars 1 GET /terraform.tfstate 1 GET /telescope/requests 1 GET /.svn/entries 1 GET /.streamlit/secrets.toml 1 GET /ssl/server.key 1 GET /ssl/localhost.key 1 GET /settings.py -- last 10 requests -- 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/aws/.env" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/aws/credentials" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/aws/.env.production" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.ht 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/s3/.aws/config" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/am 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/terraform.tfvars" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +ht 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/s3/credentials" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/am 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/.sendgrid.env" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; 35.195.83.253 - - [13/Aug/2026:02:36:13 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/var/www/html/.env" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/ 35.195.83.253 - - [13/Aug/2026:02:36:14 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/serverless.yml" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 35.195.83.253 - - [13/Aug/2026:02:36:14 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7624 "https://bigdeals.com.au/serverless.yaml" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybo == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 6 GET / 1 POST /wp-cron.php 1 GET /@fs/var/www/html/.env 1 GET /@fs/var/www/html/.aws/credentials 1 GET /@fs/var/www/.env 1 GET /@fs/var/www/.aws/credentials 1 GET /@fs/usr/src/app/.env 1 GET /@fs/usr/src/app/.aws/credentials 1 GET /@fs/src/.env 1 GET /@fs/root/terraform.tfstate 1 GET /@fs/root/rootkey.csv 1 GET /@fs/root/.env -- last 10 requests -- 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/home/ubuntu/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/app/.env.local?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/var/www/html/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/var/www/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/usr/src/app/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/root/terraform.tfstate?raw?? HTTP/1.1" 404 119101 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/app/terraform.tfvars?raw?? HTTP/1.1" 404 119099 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/app/terraform.tfstate?raw?? HTTP/1.1" 404 119100 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/app/.terraform/terraform.tfstate?raw?? HTTP/1.1" 404 119111 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 136.85.33.248 - - [13/Aug/2026:02:38:34 +1000] "GET /@fs/app/serverless.yml?raw?? HTTP/1.1" 404 119097 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" == infinium/infinium.net.au-ssl_log == -- top paths -- 14 GET /wp-login.php 13 POST /wp-login.php 5 POST /wp-cron.php 5 POST / 3 GET /wp-json/wp/v2/users/me 1 GET /.git/config -- last 10 requests -- 167.99.71.20 - - [13/Aug/2026:02:37:57 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 167.99.71.20 - - [13/Aug/2026:02:37:59 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/13 108.179.192.20 - - [13/Aug/2026:02:38:00 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 401 82 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 209.42.18.223 - - [13/Aug/2026:02:38:10 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 401 82 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 118.127.40.55 - - [13/Aug/2026:02:38:12 +1000] "POST /wp-cron.php?doing_wp_cron=1786552692.9268140792846679687500 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 50.6.231.19 - - [13/Aug/2026:02:38:12 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 50.6.231.19 - - [13/Aug/2026:02:38:13 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133 157.230.98.178 - - [13/Aug/2026:02:38:17 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 157.230.98.178 - - [13/Aug/2026:02:38:18 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 34.50.190.141 - - [13/Aug/2026:02:38:25 +1000] "GET /.git/config HTTP/1.1" 404 67076 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-13 02:36:14 L1=0.37 run=2 blk=0 avail=7955 (67.8%) swpO=0 conn=3 myRSS=1662 php=0 phpRSS=0 ap=32 tcp=38 topuser=- 2026-08-13 02:36:22 L1=0.42 run=1 blk=0 avail=7998 (68.2%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=25 tcp=22 topuser=evolution 2026-08-13 02:36:24 L1=0.63 run=1 blk=0 avail=8021 (68.4%) swpO=0 conn=3 myRSS=1662 php=0 phpRSS=0 ap=23 tcp=21 topuser=- 2026-08-13 02:36:32 L1=0.58 run=2 blk=0 avail=8042 (68.6%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=40 ap=18 tcp=26 topuser=evolution 2026-08-13 02:36:34 L1=0.53 run=2 blk=0 avail=8059 (68.7%) swpO=0 conn=3 myRSS=1662 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-13 02:36:42 L1=0.49 run=2 blk=0 avail=7910 (67.4%) swpO=0 conn=2 myRSS=1662 php=3 phpRSS=220 ap=17 tcp=26 topuser=infinium 2026-08-13 02:36:44 L1=0.61 run=2 blk=0 avail=7823 (66.7%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=252 ap=18 tcp=28 topuser=madalice 2026-08-13 02:36:52 L1=0.56 run=1 blk=0 avail=8019 (68.4%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=19 tcp=21 topuser=evolution 2026-08-13 02:36:54 L1=0.52 run=1 blk=0 avail=8034 (68.5%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-13 02:37:02 L1=0.47 run=3 blk=0 avail=7979 (68.0%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=17 tcp=20 topuser=evolution 2026-08-13 02:37:04 L1=0.52 run=3 blk=0 avail=7719 (65.8%) swpO=0 conn=2 myRSS=1662 php=2 phpRSS=324 ap=17 tcp=21 topuser=madalice 2026-08-13 02:37:12 L1=0.47 run=3 blk=0 avail=7845 (66.9%) swpO=0 conn=2 myRSS=1662 php=3 phpRSS=233 ap=17 tcp=22 topuser=infinium 2026-08-13 02:37:14 L1=0.44 run=2 blk=0 avail=7933 (67.6%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=137 ap=17 tcp=19 topuser=alison 2026-08-13 02:37:22 L1=0.40 run=1 blk=0 avail=8031 (68.5%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=17 tcp=20 topuser=evolution 2026-08-13 02:37:24 L1=0.37 run=4 blk=0 avail=7901 (67.4%) swpO=0 conn=2 myRSS=1662 php=2 phpRSS=212 ap=16 tcp=22 topuser=corpkicks 2026-08-13 02:37:32 L1=0.42 run=1 blk=0 avail=7989 (68.1%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=23 tcp=21 topuser=evolution 2026-08-13 02:37:34 L1=0.39 run=1 blk=0 avail=7909 (67.4%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=121 ap=23 tcp=19 topuser=infinium 2026-08-13 02:37:42 L1=0.36 run=2 blk=0 avail=7869 (67.1%) swpO=0 conn=2 myRSS=1662 php=2 phpRSS=227 ap=17 tcp=21 topuser=madalice 2026-08-13 02:37:44 L1=0.41 run=2 blk=0 avail=7850 (66.9%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=219 ap=17 tcp=21 topuser=corpkicks 2026-08-13 02:37:52 L1=0.45 run=1 blk=0 avail=8029 (68.5%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=17 tcp=22 topuser=evolution 2026-08-13 02:37:54 L1=0.42 run=1 blk=0 avail=8037 (68.5%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=17 tcp=20 topuser=- 2026-08-13 02:38:02 L1=0.47 run=1 blk=0 avail=8026 (68.4%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=16 tcp=23 topuser=evolution 2026-08-13 02:38:04 L1=0.43 run=1 blk=0 avail=8036 (68.5%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-13 02:38:12 L1=0.39 run=2 blk=0 avail=7947 (67.8%) swpO=0 conn=2 myRSS=1662 php=2 phpRSS=147 ap=16 tcp=22 topuser=infinium 2026-08-13 02:38:14 L1=0.60 run=1 blk=0 avail=8036 (68.5%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-13 02:38:22 L1=0.63 run=1 blk=0 avail=8035 (68.5%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=16 tcp=17 topuser=evolution 2026-08-13 02:38:24 L1=0.58 run=2 blk=0 avail=8046 (68.6%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-13 02:38:32 L1=0.73 run=3 blk=0 avail=7840 (66.8%) swpO=22 conn=2 myRSS=1662 php=3 phpRSS=273 ap=22 tcp=22 topuser=madalice 2026-08-13 02:38:34 L1=0.73 run=11 blk=0 avail=7600 (64.8%) swpO=22 conn=2 myRSS=1662 php=8 phpRSS=677 ap=21 tcp=34 topuser=evolution 2026-08-13 02:38:43 L1=1.89 run=19 blk=0 avail=6470 (55.2%) swpO=26 conn=11 myRSS=1662 php=12 phpRSS=1686 ap=20 tcp=53 topuser=evolution