INCIDENT 2026-08-18 10:30:52 trigger: swapout=3180/s php_procs=27 php_rss=4281MB mysql_conn=25 ================================================================== load: 5.09 2.86 2.81 31/709 1378807 ncpu:10 mem_avail: 3070MB/11729MB (26.2%) swap_used:2266MB swapout:3180/s blocked(D):0 running:24 iowait:0.4% steal:0.0% php: 27 procs / 4281MB heaviest user: madalice (19 procs, 3510MB) apache: 59 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 19 3676 mysql 1 2616 root 235 907 nobody 58 831 corpkicks 2 424 evolution 9 272 netdata 8 235 customc 1 117 alison 3 67 mailnull 8 66 cpanellogin 1 61 wp-toolkit 6 31 dovenull 6 26 kurri 2 22 zabbix 1 13 mailman 20 13 lowrange 1 12 nscd 1 8 dovecot 3 8 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 19 3703 corpkicks 2 424 evolution 5 255 customc 1 117 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4875 MB Active(file): 1172 MB Inactive(file): 1438 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 347 MB CommitLimit: 9960 MB Committed_AS: 12374 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 09:19:37 4440 /usr/bin/imunify-agent-proxy 1377328 root 01:20 59240 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2676080 8.0 Ssl 3-02:40:16 /usr/sbin/mariadbd 1378716 1378293 corpkicks 266952 25.8 S 00:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1378726 1373328 madalice 235976 39.5 S 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378728 1376710 madalice 235924 46.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378729 1376791 madalice 235680 45.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378736 1378295 madalice 235568 45.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378722 1377538 madalice 235560 39.0 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378741 1378088 madalice 235528 44.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378724 1376284 madalice 235508 36.3 S 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378740 1376816 madalice 235400 46.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378721 1376815 madalice 235360 40.1 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378734 1378307 madalice 235144 47.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378731 1376134 madalice 227144 45.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378747 1378746 madalice 213872 56.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378739 1378356 madalice 207116 42.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378752 1378750 madalice 204868 71.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378742 1376810 madalice 199764 41.4 S 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378732 1376790 madalice 193372 36.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 188376 2.5 Ssl 50-00:20:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2575382 1 root 185676 0.0 Ss 3-02:40:19 /usr/lib/systemd/systemd-journald 1378743 1378312 madalice 170452 33.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378733 1376927 corpkicks 170316 19.6 R 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1000360 998750 root 168688 0.0 S 08:06:04 spamd child 998750 1 root 129912 0.0 Ss 08:08:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1378749 1376776 customc 125144 15.7 D 00:04 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1378765 1378763 madalice 112280 43.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1000361 998750 root 111004 0.0 S 08:06:04 spamd child 1378766 1378762 madalice 90104 28.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1378730 1376809 evolution 71608 4.0 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1378737 1378314 evolution 66956 3.6 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1366966 1353308 cpanellogin 62740 0.1 S 12:35 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1377328 1 root 59240 2.0 Ssl 01:20 /opt/imunify360/venv/bin/python3 -m imav.run 1378744 1378357 evolution 42988 0.8 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1373402 3828812 alison 42568 0.2 S 05:25 dovecot/imap 1353308 1 root 41888 0.0 Ss 27-07:49:28 cpsrvd (SSL) - waiting for connections 2223 1201 root 40088 0.0 Sl 50-00:20:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1378757 1376252 evolution 40088 1.3 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1378789 1376792 evolution 40080 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1378819 1353308 root 34032 0.0 S 00:01 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 26480 0.1 Sl 50-00:20:53 /usr/libexec/netdata/plugins.d/go.d.plugin 1 998083 1 root 23832 0.0 Ss 08:08:42 lfd - sleeping 1463 1 root 22404 0.0 Ss 50-00:20:57 tailwatchd 1376809 1276780 nobody 21288 0.1 S 01:37 /usr/sbin/httpd -k start 1469 1 root 21176 0.1 Ss 50-00:20:57 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1376790 1276780 nobody 20652 0.1 S 01:38 /usr/sbin/httpd -k start 1376814 1276780 nobody 20356 0.0 S 01:37 /usr/sbin/httpd -k start 1376791 1276780 nobody 19700 0.0 S 01:38 /usr/sbin/httpd -k start 1376815 1276780 nobody 19492 0.0 S 01:37 /usr/sbin/httpd -k start 1376775 1276780 nobody 19016 0.0 S 01:39 /usr/sbin/httpd -k start 1376792 1276780 nobody 18752 0.0 S 01:38 /usr/sbin/httpd -k start 1376816 1276780 nobody 18700 0.0 S 01:37 /usr/sbin/httpd -k start 1377538 1276780 nobody 18608 0.1 S 01:10 /usr/sbin/httpd -k start 1376808 1276780 nobody 18536 0.0 S 01:37 /usr/sbin/httpd -k start 1378357 1276780 nobody 17816 0.0 S 00:33 /usr/sbin/httpd -k start 1376810 1276780 nobody 17768 0.0 S 01:37 /usr/sbin/httpd -k start 1378292 1276780 nobody 17668 0.0 S 00:38 /usr/sbin/httpd -k start 1376819 1276780 nobody 17276 0.0 S 01:37 /usr/sbin/httpd -k start 1378313 1276780 nobody 16784 0.0 S 00:37 /usr/sbin/httpd -k start 1378314 1276780 nobody 16784 0.0 S 00:37 /usr/sbin/httpd -k start 1378240 1276780 nobody 16776 0.0 S 00:40 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 1378736 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 6745644 | root | 85-1559715131 | Execute | 4 | Sending data | SELECT SQL_CALC_FOUND_ROWS purchases.*, DATE_FORMAT(FROM_UNIXTIME(purchases.emailed), '%d-%m-%Y') as emailDate, contacts.company,contacts.firstname,contacts.lastname send_status, date_sent from purchases LEFT JOIN contacts ON contacts.clientid=purchases.supplierid LEFT JOIN staff ON staff.i | | 6745747 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 720 evolution/portal.evolutionerp.com.au-ssl_log 194 madalice/madalice.com.au-ssl_log 97 otter2/otterfencing.net.au-ssl_log 80 customc/customcentral.com.au 38 corpkicks/corporatekicks.com.au-ssl_log 30 customc/customcentral.com.au-ssl_log 25 aaa/aaadownunder.com.au-ssl_log 22 olympic/olympicfencing.com.au-ssl_log 9 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 438 203.54.180.238 259 103.104.165.99 117 103.104.164.114 84 20.91.215.254 81 20.1.169.243 59 20.104.85.180 36 193.82.239.232 24 68.155.155.23 21 147.161.213.78 19 116.91.221.198 18 182.239.240.254 9 118.127.40.55 8 180.181.236.49 7 115.128.106.35 3 52.167.144.166 --- top request paths across all vhosts (last 3 min) --- 256 POST /functions.php 115 GET /app/ajax.php 65 GET /factory_session_checker.php 64 GET /heartbeat.php 53 GET /index.php 40 POST /plugins/csvexporter/plugin.php 33 GET /factory_session_processed_qty.php 32 GET /factory_session_joiner.php 24 POST //functions.php 22 POST /clienteditsave.php 19 GET //app/ajax.php 18 POST /app/ajax/selectFilterSingle.php 17 POST /quoteditsave.php 17 POST /jobeditsave.php 17 POST /app/ajax.php 15 POST /app/ajax/selectFilter.php 13 POST /plugins/fencecosting/plugin.php 11 POST /logsave.php 10 POST /inveditsave.php 10 POST //app/ajax/selectFilter.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 256 POST /functions.php 115 GET /app/ajax.php 53 GET /index.php 40 POST /plugins/csvexporter/plugin.php 24 POST //functions.php 22 POST /clienteditsave.php 19 GET //app/ajax.php 18 POST /app/ajax/selectFilterSingle.php 17 POST /quoteditsave.php 17 POST /jobeditsave.php 17 POST /app/ajax.php 15 POST /app/ajax/selectFilter.php -- last 10 requests -- 182.239.240.254 - - [18/Aug/2026:10:30:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [18/Aug/2026:10:30:47 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12004&tab=filestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 103.104.165.99 - - [18/Aug/2026:10:30:47 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11992&tab=jobeditmf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 203.54.180.238 - - [18/Aug/2026:10:30:47 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=billadd&billid=19728" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [18/Aug/2026:10:30:47 +1000] "GET /index.php?page=purchasereg HTTP/1.1" 200 15155 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G 103.104.165.99 - - [18/Aug/2026:10:30:47 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [18/Aug/2026:10:30:48 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchasereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=14060370147 HTTP/1.1" 200 162 "https://my.evolutionerp.com.au/index.p 103.104.165.99 - - [18/Aug/2026:10:30:48 +1000] "POST /purchaseaddsave.php?call=fetch HTTP/1.1" 200 8518 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 103.104.165.99 - - [18/Aug/2026:10:30:47 +1000] "GET /mfreqsave.php?call=delreq&id=11157&jobid=11992 HTTP/1.1" 302 50 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11992&tab=jobeditmf" "Mozilla/5.0 (Windows N 103.104.164.114 - - [18/Aug/2026:10:30:48 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=66763" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 65 GET /factory_session_checker.php 64 GET /heartbeat.php 33 GET /factory_session_processed_qty.php 32 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:10:30:35 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [18/Aug/2026:10:30:36 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:10:30:36 +1000] "GET /heartbeat.php?sentAt=1787013036&bytes=106,131,167,172&_=1787012736266 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=7 203.54.180.238 - - [18/Aug/2026:10:30:37 +1000] "GET /heartbeat.php?sentAt=1787013037&bytes=106,131,167,173&_=1786971217388 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:10:30:37 +1000] "GET /heartbeat.php?sentAt=1787013035&bytes=106,131,167,171&_=1787002018135 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:10:30:38 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:10:30:39 +1000] "GET /heartbeat.php?sentAt=1787013039&bytes=106,131,167,175&_=1787002625489 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:10:30:41 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:10:30:43 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:10:30:44 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb == madalice/madalice.com.au-ssl_log == -- top paths -- 4 POST /wp-admin/admin-ajax.php 2 GET /store/toys-kids-custom-shoes/ 2 GET /store/hand-painted-nike-air-force-1-butterfly/ 2 GET /chosen.php 1 GET /xmrlpc.php 1 GET /wp-post.php 1 GET /wp.php 1 GET /wp-includes/widgets.php 1 GET /wp-includes/style-engine/about.php 1 GET /wp-includes/js/tinymce/themes/login.php 1 GET /wp/images/my.php 1 GET /wp-content/uploads/index.php/wp-includes/Text/ -- last 10 requests -- 114.119.131.88 - - [18/Aug/2026:10:30:12 +1000] "GET /store/toys-kids-custom-shoes/?amp%3Bwcpr_page=2&verified=1&rating=3&wcpr_verified=1 HTTP/1.1" 200 49023 "https://madalice.com.au/store/toys-kids-custom-shoes/?amp%3Bw 20.91.215.254 - - [18/Aug/2026:10:30:15 +1000] "GET /al.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.91.215.254 - - [18/Aug/2026:10:30:16 +1000] "GET /wp.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.91.215.254 - - [18/Aug/2026:10:30:16 +1000] "GET /wp-activat.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.91.215.254 - - [18/Aug/2026:10:30:16 +1000] "GET /wp-admin/user/xmrlpc.php?p= HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.91.215.254 - - [18/Aug/2026:10:30:16 +1000] "GET /past1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.91.215.254 - - [18/Aug/2026:10:30:17 +1000] "GET /file61.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.91.215.254 - - [18/Aug/2026:10:30:17 +1000] "GET /wp-content/themes/twentytwentythree/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 20.91.215.254 - - [18/Aug/2026:10:30:17 +1000] "GET /license.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 216.244.66.236 - - [18/Aug/2026:10:30:16 +1000] "GET /store/turtles-custom-shoes/feed/ HTTP/1.1" 404 30559 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)" --- last 30 samples (run-up to this incident) --- 2026-08-18 10:28:24 L1=1.61 run=2 blk=0 avail=6449 (55.0%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=151 ap=34 tcp=37 topuser=corpkicks 2026-08-18 10:28:32 L1=1.43 run=1 blk=0 avail=6521 (55.6%) swpO=0 conn=2 myRSS=2659 php=0 phpRSS=0 ap=41 tcp=43 topuser=- 2026-08-18 10:28:34 L1=1.43 run=1 blk=0 avail=6528 (55.7%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=39 tcp=36 topuser=- 2026-08-18 10:28:42 L1=1.44 run=1 blk=0 avail=6445 (55.0%) swpO=0 conn=2 myRSS=2659 php=0 phpRSS=0 ap=51 tcp=51 topuser=- 2026-08-18 10:28:44 L1=1.44 run=1 blk=0 avail=6454 (55.0%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=49 tcp=44 topuser=- 2026-08-18 10:28:52 L1=1.68 run=1 blk=0 avail=6506 (55.5%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=42 tcp=36 topuser=- 2026-08-18 10:28:54 L1=1.68 run=3 blk=0 avail=6480 (55.3%) swpO=0 conn=3 myRSS=2659 php=2 phpRSS=96 ap=40 tcp=41 topuser=evolution 2026-08-18 10:29:02 L1=1.57 run=3 blk=0 avail=6403 (54.6%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=145 ap=38 tcp=45 topuser=madalice 2026-08-18 10:29:04 L1=1.57 run=2 blk=0 avail=6382 (54.4%) swpO=0 conn=3 myRSS=2659 php=3 phpRSS=202 ap=38 tcp=53 topuser=aaa 2026-08-18 10:29:12 L1=1.64 run=5 blk=0 avail=6373 (54.3%) swpO=0 conn=1 myRSS=2659 php=5 phpRSS=254 ap=40 tcp=49 topuser=evolution 2026-08-18 10:29:14 L1=1.64 run=8 blk=0 avail=6339 (54.0%) swpO=0 conn=3 myRSS=2661 php=6 phpRSS=312 ap=43 tcp=63 topuser=evolution 2026-08-18 10:29:22 L1=1.99 run=4 blk=0 avail=6083 (51.9%) swpO=0 conn=1 myRSS=2663 php=2 phpRSS=220 ap=70 tcp=80 topuser=customc 2026-08-18 10:29:24 L1=1.99 run=4 blk=0 avail=6093 (52.0%) swpO=0 conn=3 myRSS=2663 php=2 phpRSS=207 ap=71 tcp=67 topuser=madalice 2026-08-18 10:29:32 L1=1.98 run=2 blk=0 avail=6301 (53.7%) swpO=0 conn=1 myRSS=2663 php=1 phpRSS=24 ap=64 tcp=44 topuser=evolution 2026-08-18 10:29:34 L1=1.98 run=3 blk=0 avail=6121 (52.2%) swpO=0 conn=3 myRSS=2663 php=1 phpRSS=137 ap=62 tcp=49 topuser=madalice 2026-08-18 10:29:42 L1=2.29 run=5 blk=0 avail=5933 (50.6%) swpO=0 conn=1 myRSS=2663 php=4 phpRSS=408 ap=56 tcp=62 topuser=madalice 2026-08-18 10:29:44 L1=2.29 run=7 blk=0 avail=5972 (50.9%) swpO=0 conn=3 myRSS=2663 php=4 phpRSS=343 ap=57 tcp=63 topuser=tubesupplies 2026-08-18 10:29:52 L1=2.09 run=5 blk=0 avail=6179 (52.7%) swpO=0 conn=5 myRSS=2663 php=3 phpRSS=238 ap=55 tcp=46 topuser=aaa 2026-08-18 10:29:54 L1=2.09 run=5 blk=0 avail=6231 (53.1%) swpO=0 conn=3 myRSS=2663 php=3 phpRSS=205 ap=53 tcp=44 topuser=evolution 2026-08-18 10:30:02 L1=2.40 run=7 blk=0 avail=5962 (50.8%) swpO=0 conn=5 myRSS=2663 php=9 phpRSS=663 ap=46 tcp=51 topuser=evolution 2026-08-18 10:30:04 L1=2.40 run=4 blk=0 avail=6270 (53.5%) swpO=0 conn=3 myRSS=2663 php=2 phpRSS=136 ap=47 tcp=61 topuser=evolution 2026-08-18 10:30:12 L1=2.35 run=4 blk=0 avail=6175 (52.7%) swpO=0 conn=5 myRSS=2663 php=3 phpRSS=293 ap=46 tcp=52 topuser=customc 2026-08-18 10:30:14 L1=2.35 run=2 blk=0 avail=6177 (52.7%) swpO=0 conn=3 myRSS=2663 php=3 phpRSS=285 ap=46 tcp=58 topuser=madalice 2026-08-18 10:30:22 L1=2.91 run=4 blk=0 avail=6142 (52.4%) swpO=0 conn=5 myRSS=2663 php=4 phpRSS=244 ap=62 tcp=64 topuser=evolution 2026-08-18 10:30:24 L1=2.91 run=9 blk=0 avail=5961 (50.8%) swpO=0 conn=3 myRSS=2663 php=10 phpRSS=550 ap=62 tcp=65 topuser=evolution 2026-08-18 10:30:32 L1=2.69 run=3 blk=0 avail=6271 (53.5%) swpO=0 conn=5 myRSS=2663 php=1 phpRSS=89 ap=55 tcp=54 topuser=customc 2026-08-18 10:30:34 L1=2.69 run=3 blk=0 avail=6162 (52.5%) swpO=0 conn=3 myRSS=2663 php=2 phpRSS=250 ap=53 tcp=47 topuser=customc 2026-08-18 10:30:42 L1=2.43 run=3 blk=0 avail=6319 (53.9%) swpO=0 conn=5 myRSS=2663 php=3 phpRSS=160 ap=48 tcp=51 topuser=evolution 2026-08-18 10:30:44 L1=2.43 run=2 blk=0 avail=6387 (54.5%) swpO=0 conn=3 myRSS=2663 php=1 phpRSS=43 ap=47 tcp=49 topuser=evolution 2026-08-18 10:30:52 L1=5.09 run=24 blk=0 avail=3070 (26.2%) swpO=3180 conn=25 myRSS=2616 php=27 phpRSS=4281 ap=59 tcp=67 topuser=madalice