INCIDENT 2026-08-17 13:20:12 trigger: swapout=3090/s php_rss=2250MB ================================================================== load: 3.86 2.53 2.12 19/692 472274 ncpu:10 mem_avail: 4615MB/11729MB (39.4%) swap_used:1917MB swapout:3090/s blocked(D):0 running:16 iowait:0.7% steal:0.0% php: 15 procs / 2250MB heaviest user: madalice (8 procs, 1813MB) apache: 63 procs tcp_estab: 39 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2609 madalice 8 1718 nobody 61 841 root 238 835 netdata 8 245 evolution 10 245 alison 2 206 kurri 3 34 dovenull 6 28 wp-toolkit 6 19 cpanellogin 1 17 mailman 20 15 zabbix 1 14 mailnull 1 14 lowrange 1 11 nscd 1 7 dovecot 3 7 named 1 6 polkitd 1 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 8 1710 evolution 5 202 alison 1 193 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4633 MB Active(file): 2576 MB Inactive(file): 1208 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 429 MB CommitLimit: 9960 MB Committed_AS: 9703 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 468355 root 04:19 60676 /opt/imunify360/venv/bin/python3 -m imav.run 471965 root 00:12 1264 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 4090795 root 12:08:57 3548 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2672432 6.3 Ssl 2-05:29:35 /usr/sbin/mariadbd 472230 471544 madalice 269876 84.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 472225 469809 madalice 269016 59.0 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 472197 472191 madalice 268068 51.0 D 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 472201 472194 madalice 266420 50.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 472231 468896 madalice 227932 67.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4146603 4140634 root 204188 0.1 S 10:47:06 spamd child 472159 471202 alison 198232 85.1 R 00:07 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 194468 2.5 Ssl 49-03:10:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4140634 1 root 144056 0.0 Ss 10:57:27 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4146604 4140634 root 118388 0.0 S 10:47:06 spamd child 472208 469868 evolution 73632 3.0 R 00:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 472240 469042 madalice 66308 21.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 468355 1 root 60676 0.5 Ssl 04:19 /opt/imunify360/venv/bin/python3 -m imav.run 2223 1201 root 54028 0.0 Sl 49-03:10:16 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2575382 1 root 45564 0.0 Ss 2-05:29:38 /usr/lib/systemd/systemd-journald 1469 1 root 41896 0.1 Ss 49-03:10:16 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41596 0.0 Ss 26-10:38:47 cpsrvd (SSL) - waiting for connections 472239 469054 evolution 40868 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 472232 470005 evolution 39308 1.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 33892 0.1 Sl 49-03:10:12 /usr/libexec/netdata/plugins.d/go.d.plugin 1 4139988 1 root 28796 0.0 Ss 10:58:00 lfd - sleeping 469791 1276780 nobody 19592 0.0 S 02:41 /usr/sbin/httpd -k start 469868 1276780 nobody 19452 0.0 S 02:38 /usr/sbin/httpd -k start 469042 1276780 nobody 18876 0.0 S 03:38 /usr/sbin/httpd -k start 471211 1276780 nobody 18672 0.0 S 01:16 /usr/sbin/httpd -k start 468896 1276780 nobody 18568 0.0 S 03:49 /usr/sbin/httpd -k start 469054 1276780 nobody 18340 0.0 S 03:37 /usr/sbin/httpd -k start 468451 1353308 cpanellogin 18164 0.0 S 04:15 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 471202 1276780 nobody 18140 0.0 S 01:17 /usr/sbin/httpd -k start 469808 1276780 nobody 18072 0.0 S 02:40 /usr/sbin/httpd -k start 471214 1276780 nobody 17980 0.0 S 01:16 /usr/sbin/httpd -k start 467805 1276780 nobody 17936 0.2 S 05:00 /usr/sbin/httpd -k start 471544 1276780 nobody 17800 0.0 R 00:51 /usr/sbin/httpd -k start 472175 1276780 nobody 17744 0.3 S 00:06 /usr/sbin/httpd -k start 471626 1276780 nobody 17608 0.0 S 00:48 /usr/sbin/httpd -k start 470009 1276780 nobody 17460 0.0 S 02:30 /usr/sbin/httpd -k start 472151 1276780 nobody 17408 0.3 S 00:08 /usr/sbin/httpd -k start 469809 1276780 nobody 17284 0.0 R 02:40 /usr/sbin/httpd -k start 469919 1276780 nobody 17144 0.0 S 02:33 /usr/sbin/httpd -k start 472196 1276780 nobody 17124 0.2 S 00:05 /usr/sbin/httpd -k start 471632 1276780 nobody 17116 0.0 S 00:47 /usr/sbin/httpd -k start 472172 1276780 nobody 17052 0.3 S 00:06 /usr/sbin/httpd -k start 472192 1276780 nobody 17036 0.2 S 00:05 /usr/sbin/httpd -k start 472195 1276780 nobody 16992 0.4 S 00:05 /usr/sbin/httpd -k start 471643 1276780 nobody 16980 0.0 S 00:46 /usr/sbin/httpd -k start 472174 1276780 nobody 16852 0.3 S 00:06 /usr/sbin/httpd -k start 472191 1276780 nobody 16736 0.2 S 00:05 /usr/sbin/httpd -k start 471426 1276780 nobody 16364 0.0 S 01:02 /usr/sbin/httpd -k start 469053 1276780 nobody 16352 0.0 S 03:37 /usr/sbin/httpd -k start 471866 1276780 nobody 16332 0.0 S 00:21 /usr/sbin/httpd -k start 471893 1276780 nobody 16264 0.0 S 00:20 /usr/sbin/httpd -k start 470931 1276780 nobody 16108 0.0 S 01:32 /usr/sbin/httpd -k start 471644 1276780 nobody 16104 0.0 S 00:46 /usr/sbin/httpd -k start 471642 1276780 nobody 16076 0.1 S 00:46 /usr/sbin/httpd -k start 470005 1276780 nobody 16064 0.0 S 02:30 /usr/sbin/httpd -k start 185104 2431 netdata 15576 2.0 Rl 4-16:46:35 /usr/libexec/netdata/plugins.d/apps.plugin 1 472161 1276780 nobody 15572 0.2 S 00:07 /usr/sbin/httpd -k start 471427 1276780 nobody 15396 0.0 S 01:02 /usr/sbin/httpd -k start 1204 1 zabbix 15192 0.2 Ssl 49-03:10:17 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3593874 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3593707 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE option_name IN ('_transient_forminator_general_data_protection_cleanup','_transient_timeout_forminator_general_data_protection_cleanup') | +---------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 522 vinesit/vinesit.com.au-ssl_log 107 whiz/whizengineering.com.au-ssl_log 97 aaa/aaadownunder.com.au-ssl_log 46 alison/alisonarts.com.au-ssl_log 45 evolution/portal.evolutionerp.com.au-ssl_log 36 otter2/otterfencing.net.au 26 madalice/madalice.com.au-ssl_log 21 corpkicks/corporatekicks.com.au-ssl_log 4 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 234 203.54.180.238 196 103.104.165.99 139 74.248.133.44 107 20.100.185.105 78 182.239.240.254 26 4.223.164.152 19 20.226.6.191 16 195.178.110.199 15 103.104.164.114 8 180.181.236.49 7 116.91.221.198 6 146.70.194.228 6 14.203.39.146 6 116.91.223.246 5 193.82.239.232 --- top request paths across all vhosts (last 3 min) --- 205 POST /functions.php 97 GET /app/ajax.php 43 GET /index.php 36 GET /heartbeat.php 28 POST /plugins/csvexporter/plugin.php 19 GET /autodiscover/autodiscover.xml 17 POST /app/ajax.php 16 POST /clienteditsave.php 16 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax/selectFilter.php 15 POST /quoteditsave.php 12 POST /billaddsave.php 9 POST /jobeditsave.php 8 POST /logsave.php 7 POST /purchaseaddsave.php 7 POST /plugins/fencecosting/plugin.php 5 POST //functions.php 5 GET //app/ajax.php 3 POST /wp-cron.php 3 GET /yanz.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 205 POST /functions.php 97 GET /app/ajax.php 43 GET /index.php 28 POST /plugins/csvexporter/plugin.php 17 POST /app/ajax.php 16 POST /clienteditsave.php 16 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax/selectFilter.php 15 POST /quoteditsave.php 12 POST /billaddsave.php 9 POST /jobeditsave.php 8 POST /logsave.php -- last 10 requests -- 103.104.165.99 - - [17/Aug/2026:13:20:07 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&supplierid=5417&contactid=5417&tid=%25%25&returnobj=itemFi 103.104.165.99 - - [17/Aug/2026:13:20:08 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11198" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 103.104.165.99 - - [17/Aug/2026:13:20:08 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D11104&call=getUserSetting&caller=ajaxSubmitLocal&seq=18823274759 HTTP/1.1" 200 165 "https://my.evolut 103.104.165.99 - - [17/Aug/2026:13:20:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11104" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [17/Aug/2026:13:20:10 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.104.165.99 - - [17/Aug/2026:13:20:09 +1000] "POST /purchaseaddsave.php?call=createBill HTTP/1.1" 200 71 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11185" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [17/Aug/2026:13:20:09 +1000] "GET /index.php?page=invedit&id=1160 HTTP/1.1" 200 36573 "https://my.evolutionerp.com.au/index.php?page=reqedit&id=9822" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [17/Aug/2026:13:20:11 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=1160&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [17/Aug/2026:13:20:11 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=77925" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [17/Aug/2026:13:20:11 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D1160%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=14953083278 HTTP/1.1" 200 110 "https://my. == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /y.php 1 GET /yanz.php 1 GET /xleet.php 1 GET /ws.php 1 GET /wso.php 1 GET /wp-sigunq.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/rest-api/ -- last 10 requests -- 20.100.185.105 - - [17/Aug/2026:13:19:11 +1000] "GET /conf_upload.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:11 +1000] "GET /content.php888 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:12 +1000] "GET /gecko-new.php.1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:12 +1000] "GET /OthioNDwMEK.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:13 +1000] "GET /sim.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:14 +1000] "GET /y.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:14 +1000] "GET /xleet.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:14 +1000] "GET /1index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:15 +1000] "GET /admin.php1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:13:19:15 +1000] "GET /M1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /ws.php 1 GET /wso.php 1 GET /wp-sigunq.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/PHPMailer/ -- last 10 requests -- 74.248.133.44 - - [17/Aug/2026:13:18:48 +1000] "GET /wp-contentt.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:48 +1000] "GET /input.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:49 +1000] "GET /disagreed.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:49 +1000] "GET /defaults.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:49 +1000] "GET /kyami.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:50 +1000] "GET /DxHhVcy2bmJ.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:50 +1000] "GET /amaxx.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:50 +1000] "GET /BIBIL0DAY.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:51 +1000] "GET /functions.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [17/Aug/2026:13:18:51 +1000] "GET /wp-comments-post.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-17 13:17:44 L1=2.60 run=6 blk=0 avail=5943 (50.7%) swpO=1 conn=2 myRSS=2674 php=2 phpRSS=161 ap=84 tcp=72 topuser=alison 2026-08-17 13:17:52 L1=2.58 run=5 blk=0 avail=6025 (51.4%) swpO=0 conn=3 myRSS=2674 php=1 phpRSS=102 ap=77 tcp=44 topuser=alison 2026-08-17 13:17:54 L1=2.58 run=3 blk=0 avail=5893 (50.2%) swpO=0 conn=2 myRSS=2674 php=2 phpRSS=281 ap=75 tcp=41 topuser=madalice 2026-08-17 13:18:02 L1=2.56 run=2 blk=0 avail=6048 (51.6%) swpO=0 conn=3 myRSS=2674 php=1 phpRSS=138 ap=67 tcp=39 topuser=alison 2026-08-17 13:18:04 L1=2.56 run=3 blk=0 avail=6152 (52.5%) swpO=0 conn=2 myRSS=2674 php=2 phpRSS=84 ap=65 tcp=39 topuser=alison 2026-08-17 13:18:12 L1=2.69 run=2 blk=0 avail=6193 (52.8%) swpO=0 conn=3 myRSS=2674 php=1 phpRSS=63 ap=57 tcp=44 topuser=alison 2026-08-17 13:18:14 L1=2.69 run=6 blk=0 avail=6065 (51.7%) swpO=0 conn=2 myRSS=2674 php=4 phpRSS=304 ap=55 tcp=39 topuser=tubesupplies 2026-08-17 13:18:22 L1=2.67 run=2 blk=0 avail=6252 (53.3%) swpO=0 conn=3 myRSS=2674 php=1 phpRSS=53 ap=48 tcp=49 topuser=alison 2026-08-17 13:18:24 L1=2.67 run=6 blk=0 avail=6123 (52.2%) swpO=0 conn=2 myRSS=2674 php=2 phpRSS=122 ap=48 tcp=45 topuser=alison 2026-08-17 13:18:32 L1=2.48 run=3 blk=0 avail=6260 (53.4%) swpO=0 conn=3 myRSS=2674 php=2 phpRSS=137 ap=42 tcp=43 topuser=alison 2026-08-17 13:18:34 L1=2.48 run=4 blk=0 avail=6213 (53.0%) swpO=0 conn=2 myRSS=2674 php=2 phpRSS=188 ap=40 tcp=37 topuser=alison 2026-08-17 13:18:42 L1=2.64 run=3 blk=0 avail=6113 (52.1%) swpO=0 conn=3 myRSS=2674 php=2 phpRSS=251 ap=43 tcp=47 topuser=alison 2026-08-17 13:18:44 L1=2.64 run=2 blk=0 avail=6303 (53.7%) swpO=0 conn=1 myRSS=2674 php=1 phpRSS=16 ap=43 tcp=47 topuser=alison 2026-08-17 13:18:52 L1=2.62 run=5 blk=0 avail=6016 (51.3%) swpO=1 conn=3 myRSS=2674 php=3 phpRSS=434 ap=37 tcp=40 topuser=corpkicks 2026-08-17 13:18:54 L1=2.62 run=5 blk=0 avail=6165 (52.6%) swpO=1 conn=1 myRSS=2674 php=3 phpRSS=276 ap=37 tcp=40 topuser=alison 2026-08-17 13:19:02 L1=2.53 run=4 blk=0 avail=6259 (53.4%) swpO=0 conn=3 myRSS=2674 php=2 phpRSS=106 ap=45 tcp=40 topuser=evolution 2026-08-17 13:19:04 L1=2.53 run=6 blk=0 avail=6111 (52.1%) swpO=0 conn=1 myRSS=2674 php=7 phpRSS=409 ap=44 tcp=44 topuser=evolution 2026-08-17 13:19:12 L1=2.68 run=1 blk=0 avail=6189 (52.8%) swpO=0 conn=3 myRSS=2674 php=1 phpRSS=145 ap=45 tcp=37 topuser=alison 2026-08-17 13:19:14 L1=2.68 run=3 blk=0 avail=6054 (51.6%) swpO=0 conn=1 myRSS=2674 php=3 phpRSS=356 ap=44 tcp=40 topuser=alison 2026-08-17 13:19:22 L1=2.27 run=2 blk=0 avail=6216 (53.0%) swpO=0 conn=3 myRSS=2674 php=2 phpRSS=177 ap=41 tcp=46 topuser=alison 2026-08-17 13:19:24 L1=2.27 run=2 blk=0 avail=6159 (52.5%) swpO=0 conn=1 myRSS=2674 php=2 phpRSS=244 ap=41 tcp=46 topuser=alison 2026-08-17 13:19:32 L1=2.30 run=2 blk=0 avail=6080 (51.8%) swpO=0 conn=3 myRSS=2674 php=2 phpRSS=249 ap=47 tcp=40 topuser=alison 2026-08-17 13:19:34 L1=2.30 run=3 blk=1 avail=6130 (52.3%) swpO=0 conn=1 myRSS=2674 php=2 phpRSS=218 ap=46 tcp=34 topuser=alison 2026-08-17 13:19:42 L1=2.10 run=2 blk=0 avail=6134 (52.3%) swpO=0 conn=3 myRSS=2674 php=2 phpRSS=276 ap=38 tcp=36 topuser=alison 2026-08-17 13:19:44 L1=2.10 run=2 blk=0 avail=6204 (52.9%) swpO=0 conn=2 myRSS=2674 php=1 phpRSS=186 ap=36 tcp=30 topuser=alison 2026-08-17 13:19:52 L1=2.00 run=2 blk=0 avail=6231 (53.1%) swpO=0 conn=3 myRSS=2674 php=1 phpRSS=193 ap=31 tcp=38 topuser=alison 2026-08-17 13:19:54 L1=2.00 run=2 blk=0 avail=6220 (53.0%) swpO=0 conn=2 myRSS=2674 php=1 phpRSS=193 ap=33 tcp=37 topuser=alison 2026-08-17 13:20:02 L1=2.39 run=3 blk=0 avail=6191 (52.8%) swpO=0 conn=3 myRSS=2674 php=2 phpRSS=251 ap=31 tcp=33 topuser=alison 2026-08-17 13:20:04 L1=2.39 run=4 blk=0 avail=6165 (52.6%) swpO=1 conn=2 myRSS=2674 php=5 phpRSS=368 ap=32 tcp=39 topuser=alison 2026-08-17 13:20:12 L1=3.86 run=16 blk=0 avail=4615 (39.4%) swpO=3090 conn=11 myRSS=2609 php=15 phpRSS=2250 ap=63 tcp=39 topuser=madalice