INCIDENT 2026-08-14 08:38:18 trigger: php_rss=1698MB ================================================================== load: 2.18 1.91 1.68 17/624 1670484 ncpu:10 mem_avail: 6306MB/11729MB (53.8%) swap_used:1018MB swapout:0/s blocked(D):0 running:16 iowait:0.0% steal:0.0% php: 13 procs / 1698MB heaviest user: madalice (10 procs, 1545MB) apache: 44 procs tcp_estab: 54 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1695 mysql 1 1686 root 233 920 nobody 43 689 netdata 8 265 aaa 3 147 alison 4 97 evolution 6 86 infinium 1 43 kurri 3 38 dovenull 6 27 candyfabcom 2 25 wp-toolkit 6 21 mailnull 3 15 mailman 20 15 zabbix 1 14 cpanellogin 1 13 dovecot 3 8 named 1 6 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1717 aaa 2 138 evolution 2 85 alison 1 58 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6237 MB Active(file): 4732 MB Inactive(file): 700 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 433 MB CommitLimit: 9960 MB Committed_AS: 9375 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 07:27:02 2848 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1726748 8.6 Ssl 06:59:17 /usr/sbin/mariadbd 1670412 1668718 madalice 230956 71.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670410 1669593 madalice 225488 71.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 217164 2.5 Ssl 45-22:28:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1670413 1668700 madalice 204260 65.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670409 1669634 madalice 202300 63.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670411 1670014 madalice 197144 61.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670419 1666840 madalice 191308 89.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451533 1444234 root 188104 0.0 S 06:01:11 spamd child 1670421 1670002 madalice 179832 83.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451534 1444234 root 179156 0.0 S 06:01:11 spamd child 1670420 1669586 madalice 165600 84.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670418 1669991 madalice 159864 80.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670422 1670417 madalice 149192 64.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1444234 1 root 140556 0.0 Ss 06:15:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 159820 1 root 132692 0.0 Ss 24-22:51:28 /usr/lib/systemd/systemd-journald 1670430 1668013 aaa 91060 76.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670431 1670260 aaa 76488 41.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670452 1668360 alison 68412 32.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1670476 1669859 evolution 67280 15.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662340 3828812 infinium 44516 0.0 S 09:13 dovecot/imap 1670496 1670426 evolution 43144 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1670498 1670425 evolution 43080 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1670501 1666838 evolution 43036 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 42180 0.1 Ss 45-22:28:19 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41772 0.0 Ss 23-05:56:50 cpsrvd (SSL) - waiting for connections 2223 1201 root 39008 0.0 Sl 45-22:28:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 38168 0.1 Sl 45-22:28:15 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1443709 1 root 30496 0.0 Ss 06:16:05 lfd - sleeping 1663310 1276780 nobody 20712 0.0 S 08:16 /usr/sbin/httpd -k start 1668360 1276780 nobody 20440 0.1 S 02:39 /usr/sbin/httpd -k start 1668688 1276780 nobody 20404 0.1 S 02:19 /usr/sbin/httpd -k start 1667714 1276780 nobody 19768 0.0 S 03:18 /usr/sbin/httpd -k start 1668700 1276780 nobody 19308 0.0 S 02:18 /usr/sbin/httpd -k start 1669626 1276780 nobody 19016 0.1 S 01:03 /usr/sbin/httpd -k start 1670014 1276780 nobody 18980 0.0 S 00:35 /usr/sbin/httpd -k start 1668718 1276780 nobody 18968 0.0 S 02:17 /usr/sbin/httpd -k start 1668013 1276780 nobody 18920 0.0 S 03:03 /usr/sbin/httpd -k start 1669586 1276780 nobody 18640 0.0 S 01:07 /usr/sbin/httpd -k start 1666840 1276780 nobody 18612 0.0 S 04:15 /usr/sbin/httpd -k start 1670013 1276780 nobody 18496 0.0 S 00:35 /usr/sbin/httpd -k start 1666829 1276780 nobody 18324 0.1 S 04:17 /usr/sbin/httpd -k start 1669860 1276780 nobody 18276 0.0 S 00:46 /usr/sbin/httpd -k start 1669593 1276780 nobody 18264 0.1 S 01:06 /usr/sbin/httpd -k start 1669234 1276780 nobody 18004 0.0 S 01:36 /usr/sbin/httpd -k start 1670002 1276780 nobody 17916 0.0 S 00:36 /usr/sbin/httpd -k start 1670015 1276780 nobody 17860 0.2 S 00:35 /usr/sbin/httpd -k start 1669592 1276780 nobody 17672 0.0 S 01:06 /usr/sbin/httpd -k start 1669847 1276780 nobody 17656 0.0 S 00:47 /usr/sbin/httpd -k start 1669858 1276780 nobody 17644 0.1 S 00:46 /usr/sbin/httpd -k start 1667263 1276780 nobody 17248 0.0 S 03:45 /usr/sbin/httpd -k start 1666838 1276780 nobody 17212 0.0 S 04:15 /usr/sbin/httpd -k start 1471 1 root 17088 0.0 Ss 45-22:28:19 cPhulkd - processor 1666835 1276780 nobody 16948 0.0 S 04:15 /usr/sbin/httpd -k start 1670001 1276780 nobody 16776 0.0 S 00:36 /usr/sbin/httpd -k start 1601939 1471 root 16748 0.0 S 01:25:20 cPhulkd - dbprocessor 1669364 1276780 nobody 16148 0.0 S 01:23 /usr/sbin/httpd -k start 1668701 1276780 nobody 15992 0.0 S 02:18 /usr/sbin/httpd -k start 1669610 1276780 nobody 15920 0.0 S 01:04 /usr/sbin/httpd -k start 1668699 1276780 nobody 15852 0.0 S 02:18 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 887014 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 502 evolution/portal.evolutionerp.com.au-ssl_log 229 whiz/whizengineering.com.au 135 olympic/olympicfencing.com.au-ssl_log 45 alison/alisonarts.com.au-ssl_log 23 madalice/madalice.com.au-ssl_log 11 otterfencing/otterfencing.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 379 203.54.180.238 143 103.104.165.99 135 20.104.100.201 63 47.236.29.118 49 116.91.223.103 44 20.104.78.132 30 150.228.151.9 28 103.104.164.114 20 195.178.110.53 12 182.239.240.254 10 180.181.236.49 5 1.141.176.34 4 157.55.39.197 4 1.145.73.14 2 216.244.66.240 --- top request paths across all vhosts (last 3 min) --- 172 POST /functions.php 103 GET /factory_session_checker.php 62 GET /app/ajax.php 52 GET /factory_session_processed_qty.php 52 GET /factory_session_joiner.php 34 POST /quoteditsave.php 34 GET /index.php 31 POST /app/ajax/selectFilter.php 24 POST / 22 POST /plugins/csvexporter/plugin.php 14 GET /heartbeat.php 12 POST /app/ajax.php 11 POST /itemModify.php 11 POST /app/ajax/selectFilterSingle.php 10 POST /jobeditsave.php 7 POST /clienteditsave.php 5 POST /purchaseaddsave.php 5 GET //app/ajax.php 4 POST /print.php 4 POST //functions.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 172 POST /functions.php 62 GET /app/ajax.php 34 POST /quoteditsave.php 31 POST /app/ajax/selectFilter.php 29 GET /index.php 22 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax.php 11 POST /itemModify.php 11 POST /app/ajax/selectFilterSingle.php 10 POST /jobeditsave.php 7 POST /clienteditsave.php 5 POST /purchaseaddsave.php -- last 10 requests -- 47.236.29.118 - - [14/Aug/2026:08:38:17 +1000] "GET /htdocs/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:17 +1000] "GET /www/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:17 +1000] "GET /html/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:18 +1000] "GET /live/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:18 +1000] "GET /prod/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:18 +1000] "GET /dev/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:18 +1000] "GET /staging/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:18 +1000] "GET /laravel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 47.236.29.118 - - [14/Aug/2026:08:38:18 +1000] "GET /symfony/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 203.54.180.238 - - [14/Aug/2026:08:38:18 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29035&tab=invoicingtab" "Mozilla/5.0 (Windows NT 10.0; Win == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 103 GET /factory_session_checker.php 52 GET /factory_session_processed_qty.php 52 GET /factory_session_joiner.php 14 GET /heartbeat.php 5 GET /index.php 3 POST /portal/register -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:08:38:08 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 130 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:08:38:08 +1000] "GET /factory_session_joiner.php?id=34552 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:08:38:08 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:08:38:09 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:08:38:10 +1000] "GET /heartbeat.php?sentAt=1786660690&bytes=106,126,71,82&_=1786602373177 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:08:38:04 +1000] "GET /index.php?page=factory_proc_queue&process=6 HTTP/1.1" 200 119958 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10 203.54.180.238 - - [14/Aug/2026:08:38:12 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:08:38:12 +1000] "GET /factory_session_joiner.php?id=34591 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:08:38:12 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:08:38:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == whiz/whizengineering.com.au == -- top paths -- 1 GET /zwso.php 1 GET /zleqd.php 1 GET /z43agz.php 1 GET /yvltn.php 1 GET //yaztn.php 1 GET /xxl.php 1 GET /xtgirlms.php 1 GET /xstelth.php 1 GET //xs5x46mb.php 1 GET /xrawp.php 1 GET /xmnou.php 1 GET /xmlss.php -- last 10 requests -- 20.104.100.201 - - [14/Aug/2026:08:36:42 +1000] "GET /9.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:42 +1000] "GET //xs5x46mb.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:42 +1000] "GET //wp5.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:43 +1000] "GET //yaztn.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:43 +1000] "GET //p4.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:43 +1000] "GET //ovarobsxs.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:43 +1000] "GET /bks.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:44 +1000] "GET /sde.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:44 +1000] "GET /rre.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [14/Aug/2026:08:36:44 +1000] "GET /vcgux.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-14 08:35:57 L1=2.43 run=6 blk=0 avail=7103 (60.6%) swpO=0 conn=2 myRSS=1678 php=5 phpRSS=637 ap=43 tcp=55 topuser=madalice 2026-08-14 08:35:57 L1=2.43 run=3 blk=1 avail=7252 (61.8%) swpO=0 conn=2 myRSS=1684 php=3 phpRSS=415 ap=43 tcp=55 topuser=corpkicks 2026-08-14 08:36:07 L1=2.74 run=6 blk=0 avail=7176 (61.2%) swpO=0 conn=2 myRSS=1685 php=4 phpRSS=441 ap=55 tcp=54 topuser=madalice 2026-08-14 08:36:07 L1=2.74 run=4 blk=0 avail=7113 (60.6%) swpO=0 conn=2 myRSS=1685 php=4 phpRSS=358 ap=55 tcp=54 topuser=madalice 2026-08-14 08:36:17 L1=2.77 run=2 blk=0 avail=7536 (64.3%) swpO=0 conn=2 myRSS=1685 php=1 phpRSS=54 ap=45 tcp=47 topuser=olympic 2026-08-14 08:36:17 L1=2.77 run=2 blk=0 avail=7511 (64.0%) swpO=0 conn=2 myRSS=1685 php=1 phpRSS=81 ap=45 tcp=46 topuser=olympic 2026-08-14 08:36:27 L1=2.72 run=4 blk=0 avail=7486 (63.8%) swpO=0 conn=3 myRSS=1685 php=2 phpRSS=178 ap=40 tcp=43 topuser=olympic 2026-08-14 08:36:27 L1=2.72 run=3 blk=0 avail=7546 (64.3%) swpO=0 conn=2 myRSS=1685 php=2 phpRSS=127 ap=40 tcp=44 topuser=alison 2026-08-14 08:36:37 L1=2.63 run=4 blk=0 avail=7328 (62.5%) swpO=0 conn=3 myRSS=1685 php=3 phpRSS=358 ap=41 tcp=45 topuser=madalice 2026-08-14 08:36:37 L1=2.63 run=6 blk=0 avail=7371 (62.8%) swpO=0 conn=2 myRSS=1685 php=2 phpRSS=282 ap=41 tcp=44 topuser=madalice 2026-08-14 08:36:47 L1=2.46 run=2 blk=0 avail=7575 (64.6%) swpO=0 conn=3 myRSS=1685 php=1 phpRSS=45 ap=40 tcp=46 topuser=olympic 2026-08-14 08:36:47 L1=2.46 run=2 blk=0 avail=7553 (64.4%) swpO=0 conn=2 myRSS=1685 php=1 phpRSS=75 ap=40 tcp=45 topuser=olympic 2026-08-14 08:36:57 L1=2.39 run=3 blk=0 avail=7518 (64.1%) swpO=0 conn=3 myRSS=1685 php=2 phpRSS=150 ap=39 tcp=49 topuser=olympic 2026-08-14 08:36:57 L1=2.39 run=4 blk=0 avail=7487 (63.8%) swpO=0 conn=2 myRSS=1685 php=2 phpRSS=179 ap=39 tcp=48 topuser=olympic 2026-08-14 08:37:07 L1=2.17 run=2 blk=0 avail=7579 (64.6%) swpO=0 conn=3 myRSS=1685 php=1 phpRSS=69 ap=37 tcp=45 topuser=olympic 2026-08-14 08:37:07 L1=2.17 run=5 blk=0 avail=7447 (63.5%) swpO=0 conn=2 myRSS=1685 php=2 phpRSS=181 ap=37 tcp=45 topuser=olympic 2026-08-14 08:37:17 L1=2.31 run=3 blk=0 avail=7563 (64.5%) swpO=0 conn=3 myRSS=1686 php=1 phpRSS=45 ap=45 tcp=47 topuser=tubesupplies 2026-08-14 08:37:17 L1=2.31 run=3 blk=0 avail=7508 (64.0%) swpO=0 conn=3 myRSS=1686 php=2 phpRSS=129 ap=45 tcp=47 topuser=tubesupplies 2026-08-14 08:37:27 L1=2.11 run=3 blk=0 avail=7615 (64.9%) swpO=0 conn=1 myRSS=1686 php=0 phpRSS=0 ap=39 tcp=42 topuser=- 2026-08-14 08:37:27 L1=2.11 run=1 blk=0 avail=7621 (65.0%) swpO=0 conn=3 myRSS=1686 php=0 phpRSS=0 ap=38 tcp=43 topuser=- 2026-08-14 08:37:37 L1=2.39 run=6 blk=0 avail=7383 (62.9%) swpO=0 conn=1 myRSS=1686 php=2 phpRSS=132 ap=44 tcp=48 topuser=evolution 2026-08-14 08:37:37 L1=2.39 run=4 blk=0 avail=7469 (63.7%) swpO=0 conn=3 myRSS=1686 php=4 phpRSS=213 ap=44 tcp=48 topuser=evolution 2026-08-14 08:37:47 L1=2.10 run=7 blk=0 avail=7185 (61.3%) swpO=0 conn=1 myRSS=1686 php=4 phpRSS=443 ap=48 tcp=48 topuser=madalice 2026-08-14 08:37:48 L1=2.10 run=5 blk=0 avail=7152 (61.0%) swpO=0 conn=3 myRSS=1686 php=4 phpRSS=518 ap=48 tcp=48 topuser=madalice 2026-08-14 08:37:57 L1=1.94 run=4 blk=0 avail=7455 (63.6%) swpO=0 conn=1 myRSS=1686 php=3 phpRSS=212 ap=45 tcp=46 topuser=evolution 2026-08-14 08:37:58 L1=1.94 run=2 blk=0 avail=7472 (63.7%) swpO=0 conn=3 myRSS=1686 php=2 phpRSS=144 ap=45 tcp=49 topuser=olympic 2026-08-14 08:38:07 L1=1.87 run=3 blk=0 avail=7397 (63.1%) swpO=0 conn=1 myRSS=1686 php=3 phpRSS=244 ap=47 tcp=50 topuser=evolution 2026-08-14 08:38:08 L1=1.87 run=5 blk=0 avail=7381 (62.9%) swpO=0 conn=3 myRSS=1686 php=4 phpRSS=268 ap=47 tcp=53 topuser=infinium 2026-08-14 08:38:17 L1=2.18 run=16 blk=0 avail=6542 (55.8%) swpO=0 conn=1 myRSS=1686 php=12 phpRSS=1459 ap=44 tcp=53 topuser=madalice 2026-08-14 08:38:18 L1=2.18 run=16 blk=0 avail=6306 (53.8%) swpO=0 conn=13 myRSS=1686 php=13 phpRSS=1698 ap=44 tcp=54 topuser=madalice