INCIDENT 2026-08-17 22:16:42 trigger: swapout=2161/s ================================================================== load: 1.56 0.88 0.87 4/635 846902 ncpu:10 mem_avail: 4134MB/11729MB (35.2%) swap_used:2167MB swapout:2161/s blocked(D):3 running:3 iowait:6.4% steal:0.0% php: 1 procs / 104MB heaviest user: madalice (1 procs, 104MB) apache: 15 procs tcp_estab: 20 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 7 2764 mysql 1 2409 root 242 823 netdata 8 243 nobody 14 223 madalice 1 104 cpanellogin 1 71 dovenull 6 27 wp-toolkit 6 18 mailman 20 14 zabbix 1 13 alison 1 13 vinesit 1 12 infinium 1 12 mailnull 1 10 kurri 1 10 dovecot 3 8 nscd 1 7 named 1 5 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 1 104 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3846 MB Active(file): 1774 MB Inactive(file): 2147 MB Dirty: 319 MB Writeback: 31 MB SReclaimable: 382 MB CommitLimit: 9960 MB Committed_AS: 9297 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 836988 root 16:41 3076 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 4090795 root 21:05:26 6804 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 846773 846772 evolution 2784236 96.0 RNs 00:19 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 2575700 1 mysql 2465780 7.3 Ssl 2-14:26:04 /usr/sbin/mariadbd 502627 4140634 root 208780 0.1 S 08:22:52 spamd child 1220 1 netdata 196520 2.5 Ssl 49-12:06:46 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4146604 4140634 root 137428 0.0 S 19:43:35 spamd child 4140634 1 root 118044 0.0 Ss 19:53:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 846869 841245 madalice 109256 44.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 817130 1353308 cpanellogin 73600 0.0 S 46:06 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 845432 3651816 root 43948 0.7 SN 02:08 cpanellogd - waiting for child to process logs for evolution 846689 845432 evolution 41964 0.1 SN 00:24 cpanellogd - http logs for evolution 2223 1201 root 41956 0.0 Sl 49-12:06:45 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41796 0.0 Ss 26-19:35:16 cpsrvd (SSL) - waiting for connections 2575382 1 root 33764 0.0 Ss 2-14:26:07 /usr/lib/systemd/systemd-journald 4922 2431 netdata 30460 0.1 Sl 49-12:06:41 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 28816 0.1 Ss 49-12:06:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4139988 1 root 26488 0.0 Ss 19:54:29 lfd - sleeping 841245 1276780 nobody 23000 0.0 S 09:46 /usr/sbin/httpd -k start 839477 1276780 nobody 22868 0.0 S 13:08 /usr/sbin/httpd -k start 840961 1276780 nobody 22256 0.0 S 10:15 /usr/sbin/httpd -k start 840455 1276780 nobody 22240 0.0 S 11:08 /usr/sbin/httpd -k start 839475 1276780 nobody 21792 0.0 S 13:08 /usr/sbin/httpd -k start 844054 1276780 nobody 20600 0.0 S 05:01 /usr/sbin/httpd -k start 842277 1276780 nobody 19644 0.0 S 08:19 /usr/sbin/httpd -k start 843928 1276780 nobody 19140 0.0 S 05:20 /usr/sbin/httpd -k start 845510 1276780 nobody 16536 0.0 S 02:01 /usr/sbin/httpd -k start 845861 1276780 nobody 16464 0.0 S 01:31 /usr/sbin/httpd -k start 185104 2431 netdata 15928 2.0 Sl 5-01:43:04 /usr/libexec/netdata/plugins.d/apps.plugin 1 1463 1 root 15528 0.0 Ss 49-12:06:45 tailwatchd 38372 1471 root 15400 0.0 S 17:27:20 cPhulkd - dbprocessor 789830 3828812 alison 13680 0.0 S 01:30:12 dovecot/imap 1204 1 zabbix 13532 0.2 Ssl 49-12:06:46 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 827257 3828812 infinium 12424 0.0 S 31:19 dovecot/imap 846760 3828812 vinesit 12364 0.0 S 00:19 dovecot/imap 846761 1471 root 11188 0.1 S 00:19 cPhulkd - processor - http socket 843931 3828812 root 11020 0.0 S 05:19 dovecot/auth -w 844062 3828812 root 10980 0.0 S 04:55 dovecot/auth -w 3816866 3828812 kurri 10968 0.0 S 1-04:25:42 dovecot/imap 1471 1 root 10848 0.0 Ss 49-12:06:45 cPhulkd - processor 844064 3828812 root 10748 0.0 S 04:55 dovecot/auth -w 281734 1 mailnull 10736 0.0 Ss 8-19:54:34 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 846842 1276780 nobody 10628 0.0 S 00:08 /usr/sbin/httpd -k start 846871 1276780 nobody 10628 0.0 S 00:02 /usr/sbin/httpd -k start 1059098 3828812 dovenull 8216 0.0 S 4-06:43:51 dovecot/imap-login 1059102 3828812 dovenull 7844 0.0 S 4-06:43:51 dovecot/imap-login 3651378 1 nscd 7704 0.0 Ssl 9-19:53:48 /usr/sbin/nscd 1466 1 root 7484 0.0 Ss 49-12:06:45 dnsadmin - dormant mode 3651102 1 root 7096 0.0 Ss 9-19:53:59 queueprocd - waiting up to 60s to process a task 4090795 1 root 6804 0.0 Ssl 21:05:26 /usr/bin/imunify-agent-proxy 1 0 root 6584 0.2 Ss 49-12:06:54 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 1059104 3828812 dovenull 6040 0.0 S 4-06:43:51 dovecot/pop3-login 1059100 3828812 dovenull 5816 0.0 S 4-06:43:51 dovecot/pop3-login 359887 2431 netdata 5712 0.0 Sl 11:03:15 /usr/libexec/netdata/plugins.d/debugfs.plugin 1 1574 1 wp-toolkit 5368 0.0 Ss 49-12:06:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2536732 1 named 5332 0.0 Ssl 45-19:54:33 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1578 1 wp-toolkit 5136 0.0 Ss 49-12:06:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1059107 3828812 dovecot 4984 0.0 S 4-06:43:50 dovecot/auth 846937 3409584 root 4332 0.0 R 00:00 ps -eo pid,ppid,user:20,rss,pcpu,stat,etime,args --sort=-rss 908514 1 evolution 3792 0.0 Ss 4-09:07:27 /usr/lib/systemd/systemd --user 1276780 1 root 3376 0.0 Ss 12-06:45:21 /usr/sbin/httpd -k start 836988 836978 root 3076 0.0 Ss 16:41 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- processes in D state (uninterruptible IO) --- 485167 D - [kworker/u256:2+flush-8:0] --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4950362 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/portal.evolutionerp.com.au-ssl_log 24 coscom/swms.coscom.com.au-ssl_log 20 evolution/my.evolutionerp.com.au-ssl_log 18 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 24 203.54.180.238 20 20.119.58.187 17 158.158.34.183 1 52.167.144.209 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 1 GET /zwso.php 1 GET /zoom1.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-content/packed.php 1 GET /wp-access.php 1 GET /wp-2019.php 1 GET /term.php 1 GET /index.php 1 GET /gecko-new.php 1 GET /fw.php 1 GET /essexec.php 1 GET /cron.php 1 GET /bthil.php 1 GET /browse.php 1 GET /av.php 1 GET /autoload_classmap.php 1 GET /atomlib.php 1 GET /asus.php 1 GET /as.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [17/Aug/2026:22:15:50 +1000] "GET /heartbeat.php?sentAt=1786968950&bytes=106,130,251,118&_=1786946838569 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:15:50 +1000] "GET /heartbeat.php?sentAt=1786968950&bytes=106,130,251,118&_=1786966237132 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:00 +1000] "GET /heartbeat.php?sentAt=1786968960&bytes=106,130,251,128&_=1786946838570 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:00 +1000] "GET /heartbeat.php?sentAt=1786968960&bytes=106,130,251,128&_=1786966237133 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:10 +1000] "GET /heartbeat.php?sentAt=1786968970&bytes=106,130,251,138&_=1786946838571 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:10 +1000] "GET /heartbeat.php?sentAt=1786968970&bytes=106,130,251,138&_=1786966237134 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:20 +1000] "GET /heartbeat.php?sentAt=1786968980&bytes=106,130,251,148&_=1786946838572 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:20 +1000] "GET /heartbeat.php?sentAt=1786968980&bytes=106,130,251,148&_=1786966237135 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:30 +1000] "GET /heartbeat.php?sentAt=1786968990&bytes=106,130,251,158&_=1786966237136 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [17/Aug/2026:22:16:30 +1000] "GET /heartbeat.php?sentAt=1786968990&bytes=106,130,251,158&_=1786946838573 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == coscom/swms.coscom.com.au-ssl_log == -- top paths -- 1 GET /av.php 1 GET /autoload_classmap.php 1 GET /atomlib.php 1 GET /asus.php 1 GET /as.php 1 GET /al.php 1 GET /alfa.php 1 GET /adminfuns.php 1 GET /about.php 1 GET /abc.php 1 GET /abcd.php 1 GET /aa.php -- last 10 requests -- 20.119.58.187 - - [17/Aug/2026:22:16:39 +1000] "GET /al.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:39 +1000] "GET /alfa.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:39 +1000] "GET /as.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:39 +1000] "GET /aa.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:39 +1000] "GET /abc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:40 +1000] "GET /av.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:40 +1000] "GET /autoload_classmap.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:40 +1000] "GET /asus.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:40 +1000] "GET /about.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [17/Aug/2026:22:16:40 +1000] "GET /atomlib.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-content/packed.php 1 GET /wp-access.php 1 GET /wp-2019.php 1 GET /term.php 1 GET /index.php 1 GET /gecko-new.php 1 GET /fw.php 1 GET /essexec.php 1 GET /cron.php -- last 10 requests -- 158.158.34.183 - - [17/Aug/2026:22:16:36 +1000] "GET /bthil.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:37 +1000] "GET /wp-content/packed.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:37 +1000] "GET /admin/function.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:37 +1000] "GET /zoom1.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:38 +1000] "GET /about.php7 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:38 +1000] "GET /cron.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:38 +1000] "GET /wp-2019.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:38 +1000] "GET /gecko-new.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:39 +1000] "GET /add_actualites.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [17/Aug/2026:22:16:39 +1000] "GET /browse.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-17 22:14:18 L1=0.42 run=1 blk=0 avail=6850 (58.4%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=17 tcp=19 topuser=- 2026-08-17 22:14:21 L1=0.42 run=3 blk=0 avail=6683 (57.0%) swpO=0 conn=2 myRSS=2476 php=2 phpRSS=216 ap=17 tcp=22 topuser=otterfencing 2026-08-17 22:14:28 L1=0.36 run=1 blk=0 avail=6855 (58.4%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=17 tcp=18 topuser=- 2026-08-17 22:14:31 L1=0.36 run=2 blk=0 avail=6861 (58.5%) swpO=0 conn=2 myRSS=2476 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-17 22:14:38 L1=0.30 run=1 blk=0 avail=6824 (58.2%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-17 22:14:41 L1=0.30 run=6 blk=0 avail=6655 (56.7%) swpO=3 conn=2 myRSS=2475 php=2 phpRSS=114 ap=15 tcp=23 topuser=alison 2026-08-17 22:14:48 L1=0.40 run=1 blk=0 avail=6815 (58.1%) swpO=3 conn=1 myRSS=2475 php=0 phpRSS=0 ap=15 tcp=17 topuser=- 2026-08-17 22:14:51 L1=0.40 run=1 blk=0 avail=6817 (58.1%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-17 22:14:58 L1=0.34 run=2 blk=0 avail=6821 (58.2%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=15 tcp=17 topuser=- 2026-08-17 22:15:02 L1=0.34 run=2 blk=0 avail=6670 (56.9%) swpO=0 conn=2 myRSS=2475 php=1 phpRSS=65 ap=13 tcp=19 topuser=evolution 2026-08-17 22:15:08 L1=0.44 run=2 blk=0 avail=6122 (52.2%) swpO=0 conn=1 myRSS=2475 php=1 phpRSS=68 ap=13 tcp=19 topuser=evolution 2026-08-17 22:15:12 L1=0.44 run=4 blk=0 avail=5771 (49.2%) swpO=1 conn=2 myRSS=2475 php=2 phpRSS=271 ap=14 tcp=20 topuser=corpkicks 2026-08-17 22:15:18 L1=0.52 run=1 blk=0 avail=6770 (57.7%) swpO=1 conn=2 myRSS=2475 php=1 phpRSS=69 ap=14 tcp=18 topuser=evolution 2026-08-17 22:15:22 L1=0.52 run=1 blk=0 avail=6774 (57.8%) swpO=0 conn=2 myRSS=2475 php=1 phpRSS=69 ap=14 tcp=18 topuser=evolution 2026-08-17 22:15:28 L1=0.44 run=1 blk=0 avail=6822 (58.2%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-17 22:15:32 L1=0.44 run=1 blk=0 avail=6821 (58.2%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=18 topuser=- 2026-08-17 22:15:38 L1=0.45 run=3 blk=0 avail=6821 (58.2%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=15 topuser=- 2026-08-17 22:15:42 L1=0.45 run=3 blk=0 avail=6814 (58.1%) swpO=0 conn=2 myRSS=2475 php=1 phpRSS=41 ap=13 tcp=19 topuser=madalice 2026-08-17 22:15:49 L1=0.69 run=2 blk=0 avail=6805 (58.0%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=17 topuser=- 2026-08-17 22:15:52 L1=0.69 run=1 blk=0 avail=6820 (58.1%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=17 topuser=- 2026-08-17 22:15:59 L1=0.81 run=3 blk=0 avail=6813 (58.1%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=15 topuser=- 2026-08-17 22:16:02 L1=0.81 run=1 blk=0 avail=6825 (58.2%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=17 topuser=- 2026-08-17 22:16:09 L1=1.00 run=3 blk=0 avail=6800 (58.0%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=17 topuser=- 2026-08-17 22:16:12 L1=1.00 run=3 blk=0 avail=6486 (55.3%) swpO=0 conn=2 myRSS=2475 php=1 phpRSS=174 ap=13 tcp=20 topuser=madalice 2026-08-17 22:16:19 L1=1.08 run=3 blk=0 avail=6823 (58.2%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=14 topuser=- 2026-08-17 22:16:22 L1=1.08 run=1 blk=0 avail=6844 (58.4%) swpO=2 conn=1 myRSS=2475 php=0 phpRSS=0 ap=13 tcp=16 topuser=- 2026-08-17 22:16:29 L1=1.22 run=2 blk=0 avail=5337 (45.5%) swpO=185 conn=1 myRSS=2471 php=0 phpRSS=0 ap=13 tcp=17 topuser=- 2026-08-17 22:16:32 L1=1.22 run=2 blk=0 avail=4432 (37.8%) swpO=277 conn=1 myRSS=2469 php=0 phpRSS=0 ap=13 tcp=23 topuser=- 2026-08-17 22:16:39 L1=1.56 run=4 blk=0 avail=4174 (35.6%) swpO=1345 conn=1 myRSS=2435 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-17 22:16:42 L1=1.56 run=3 blk=3 avail=4134 (35.2%) swpO=2161 conn=2 myRSS=2411 php=1 phpRSS=104 ap=15 tcp=20 topuser=madalice