INCIDENT 2026-08-18 14:00:02 trigger: php_rss=1611MB mysql_conn=16 ================================================================== load: 0.78 1.04 1.59 21/804 1593816 ncpu:10 mem_avail: 5440MB/11729MB (46.4%) swap_used:2977MB swapout:0/s blocked(D):0 running:15 iowait:0.2% steal:0.0% php: 15 procs / 1611MB heaviest user: madalice (8 procs, 1264MB) apache: 152 procs tcp_estab: 126 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 151 2246 mysql 1 2000 madalice 8 1382 root 252 643 evolution 12 401 netdata 8 264 cpanellogin 1 107 kurri 6 65 dovenull 6 26 wp-toolkit 6 18 zabbix 1 15 mailnull 2 15 mailman 20 12 alison 1 12 lowrange 1 11 dovecot 3 7 nscd 1 6 named 1 5 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 8 1397 evolution 8 388 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5537 MB Active(file): 3501 MB Inactive(file): 1362 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 312 MB CommitLimit: 9960 MB Committed_AS: 11564 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 12:48:46 1120 /usr/bin/imunify-agent-proxy 1593616 root 00:01 3260 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1593617 root 00:01 1376 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2048552 9.2 Ssl 3-06:09:25 /usr/sbin/mariadbd 1593586 1593479 madalice 226776 108 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1593582 1593472 madalice 224884 108 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1593584 1593471 madalice 223916 109 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1593581 1593468 madalice 211916 106 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 203484 2.5 Ssl 50-03:50:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1593587 1593477 madalice 202876 98.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1593585 1593475 madalice 196648 100 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1593592 1593470 madalice 185816 87.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1564373 1353308 cpanellogin 109652 0.0 S 29:57 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1593779 1593467 madalice 99936 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 998750 1 root 91128 0.0 Ss 11:37:18 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 88796 0.0 S 17:34 spamd child 1000361 998750 root 73636 0.0 S 11:35:13 spamd child 1593644 1593608 evolution 69536 19.0 Rs 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1593589 1593461 evolution 68840 9.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1593827 1593430 evolution 67080 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2575382 1 root 64064 0.0 Ss 3-06:09:28 /usr/lib/systemd/systemd-journald 1593634 1593607 evolution 55788 159 Rs 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/invoicing.php 4922 2431 netdata 43304 0.1 Sl 50-03:50:02 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 41888 0.0 Ss 27-11:18:37 cpsrvd (SSL) - waiting for connections 1593643 1593457 evolution 41264 6.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1593637 1593480 evolution 39596 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1593727 1593458 evolution 39092 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 34436 0.0 Sl 50-03:50:06 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 26936 0.1 Ss 50-03:50:06 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1589376 1276780 nobody 21240 0.0 S 05:23 /usr/sbin/httpd -k start 1591038 1276780 nobody 20912 0.0 S 03:20 /usr/sbin/httpd -k start 1589462 1276780 nobody 20024 0.0 S 05:22 /usr/sbin/httpd -k start 1591521 1276780 nobody 19712 0.0 S 02:39 /usr/sbin/httpd -k start 1592318 1276780 nobody 19652 0.0 S 01:35 /usr/sbin/httpd -k start 1590137 1276780 nobody 19528 0.0 S 04:23 /usr/sbin/httpd -k start 998083 1 root 19364 0.0 Ss 11:37:51 lfd - sleeping 1591313 1276780 nobody 19360 0.0 S 02:54 /usr/sbin/httpd -k start 1590138 1276780 nobody 19220 0.0 S 04:23 /usr/sbin/httpd -k start 1593281 1276780 nobody 19160 0.0 S 00:21 /usr/sbin/httpd -k start 1590542 1276780 nobody 19128 0.1 S 03:45 /usr/sbin/httpd -k start 1591037 1276780 nobody 19116 0.0 S 03:20 /usr/sbin/httpd -k start 1590854 1276780 nobody 18944 0.0 S 03:27 /usr/sbin/httpd -k start 1592599 1276780 nobody 18852 0.0 S 01:11 /usr/sbin/httpd -k start 1591023 1276780 nobody 18644 0.0 S 03:21 /usr/sbin/httpd -k start 1590553 1276780 nobody 18396 0.0 S 03:44 /usr/sbin/httpd -k start 1593652 1593648 root 18228 3.0 S 00:01 /usr/local/cpanel/bin/dcpumon 1593077 1276780 nobody 18068 0.0 S 00:38 /usr/sbin/httpd -k start 1593478 1276780 nobody 17756 0.1 S 00:07 /usr/sbin/httpd -k start 1593371 1276780 nobody 17720 0.0 S 00:11 /usr/sbin/httpd -k start 1592657 1276780 nobody 17568 0.1 S 01:10 /usr/sbin/httpd -k start 1591803 1276780 nobody 17532 0.0 S 02:23 /usr/sbin/httpd -k start 1591520 1276780 nobody 17484 0.0 S 02:39 /usr/sbin/httpd -k start 1593497 1276780 nobody 17464 0.0 S 00:06 /usr/sbin/httpd -k start 1593494 1276780 nobody 17412 0.1 S 00:06 /usr/sbin/httpd -k start 1592395 1276780 nobody 17356 0.0 S 01:30 /usr/sbin/httpd -k start 1593331 1276780 nobody 17260 0.0 S 00:20 /usr/sbin/httpd -k start 1593462 1276780 nobody 17064 0.2 S 00:07 /usr/sbin/httpd -k start 1592408 1276780 nobody 17044 0.0 S 01:29 /usr/sbin/httpd -k start 1592575 1276780 nobody 17028 0.0 S 01:13 /usr/sbin/httpd -k start 1592660 1276780 nobody 16992 0.0 S 01:10 /usr/sbin/httpd -k start 1463 1 root 16976 0.0 Ss 50-03:50:06 tailwatchd 1593330 1276780 nobody 16940 0.1 S 00:20 /usr/sbin/httpd -k start 1592471 1276780 nobody 16680 0.0 S 01:22 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8421699 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 8421698 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 356 evolution/portal.evolutionerp.com.au-ssl_log 209 bigdeals/bigdeals.com.au-ssl_log 20 madalice/madalice.com.au-ssl_log 15 corpkicks/corporatekicks.com.au-ssl_log 12 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 318 203.54.180.238 107 182.239.240.254 68 103.104.165.99 36 103.104.164.114 20 20.119.58.187 8 147.161.213.78 8 1.144.107.82 7 203.31.118.167 7 2001:8004:14b3:854f:bd6c:e4b0:f36b:9f9d 5 118.127.40.55 4 203.214.146.60 4 193.82.239.232 4 147.161.213.98 3 165.225.233.117 2 180.181.236.49 --- top request paths across all vhosts (last 3 min) --- 178 POST /functions.php 74 GET /factory_session_checker.php 55 GET /app/ajax.php 49 GET /heartbeat.php 38 GET /factory_session_processed_qty.php 38 GET /factory_session_joiner.php 33 GET /index.php 14 POST /inveditsave.php 12 POST /wp-admin/admin-ajax.php 11 POST //functions.php 8 POST /app/ajax.php 8 GET //app/ajax.php 7 POST /plugins/csvexporter/plugin.php 7 POST /app/ajax/selectFilterSingle.php 5 POST /purchaseaddsave.php 5 POST /portal/register 4 POST /quoteditsave.php 4 POST /plugins/fencecosting/plugin.php 4 POST /jobeditsave.php 4 POST /dispatchsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 178 POST /functions.php 55 GET /app/ajax.php 28 GET /index.php 14 POST /inveditsave.php 11 POST //functions.php 8 POST /app/ajax.php 8 GET //app/ajax.php 7 POST /plugins/csvexporter/plugin.php 7 POST /app/ajax/selectFilterSingle.php 5 POST /purchaseaddsave.php 4 POST /quoteditsave.php 4 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 203.214.146.60 - - [18/Aug/2026:14:00:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=3362&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 147.161.213.98 - - [18/Aug/2026:14:00:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=2698" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 203.54.180.238 - - [18/Aug/2026:14:00:00 +1000] "POST /purchaseaddsave.php?save=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=14061" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A 193.82.239.232 - - [18/Aug/2026:14:00:02 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36768" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 182.239.240.254 - - [18/Aug/2026:14:00:00 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 13344 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4164&tab=purchasetab" "Mozilla/5.0 (Windows NT 10.0; W 182.239.240.254 - - [18/Aug/2026:14:00:01 +1000] "POST /app/ajax/selectFilter.php?call=filterstaffandcontractors&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%201000&excludelabour=1&include=40&contactid=14&returnob 182.239.240.254 - - [18/Aug/2026:14:00:02 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4164&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 103.104.164.114 - - [18/Aug/2026:14:00:03 +1000] "POST //jobeditsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=79&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 103.104.164.114 - - [18/Aug/2026:14:00:03 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=1667§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [18/Aug/2026:14:00:01 +1000] "GET / HTTP/1.1" 200 21947 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.3 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 74 GET /factory_session_checker.php 49 GET /heartbeat.php 38 GET /factory_session_processed_qty.php 38 GET /factory_session_joiner.php 5 POST /portal/register 5 GET /index.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:13:59:56 +1000] "GET /heartbeat.php?sentAt=1787025590&bytes=106,131,216,182&_=1787023440482 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 203.54.180.238 - - [18/Aug/2026:13:59:59 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [18/Aug/2026:13:59:59 +1000] "GET /factory_session_joiner.php?id=34689 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [18/Aug/2026:14:00:00 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9043 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37731&seq=1666268152680" "Mozill 203.54.180.238 - - [18/Aug/2026:14:00:00 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:14:00:00 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, 203.54.180.238 - - [18/Aug/2026:14:00:00 +1000] "GET /heartbeat.php?sentAt=1787025600&bytes=106,131,216,192&_=1787023440483 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 203.54.180.238 - - [18/Aug/2026:14:00:01 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:14:00:00 +1000] "GET /heartbeat.php?sentAt=1787025597&bytes=106,131,216,189&_=1786971218644 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:14:00:00 +1000] "GET /heartbeat.php?sentAt=1787025595&bytes=106,131,216,187&_=1787002019391 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-content/themes/admin.php 1 GET /wp-content/admin.php 1 GET /wp-admin/maint/ 1 GET /worksec.php 1 GET /wk/ 1 GET /txets.php 1 GET /term.php 1 GET /mini 1 GET /goods.php 1 GET /file.php -- last 10 requests -- 20.119.58.187 - - [18/Aug/2026:13:58:34 +1000] "GET /endpoints/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:34 +1000] "GET /file.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:34 +1000] "GET /goods.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:34 +1000] "GET /term.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:34 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:35 +1000] "GET /admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:35 +1000] "GET /adminfuns.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:35 +1000] "GET /wp-mail.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:35 +1000] "GET /wp.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [18/Aug/2026:13:58:35 +1000] "GET /worksec.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-18 13:57:41 L1=0.86 run=4 blk=0 avail=7127 (60.8%) swpO=1 conn=2 myRSS=1998 php=5 phpRSS=296 ap=50 tcp=58 topuser=evolution 2026-08-18 13:57:42 L1=0.86 run=4 blk=0 avail=7123 (60.7%) swpO=1 conn=3 myRSS=1998 php=2 phpRSS=195 ap=50 tcp=57 topuser=alison 2026-08-18 13:57:51 L1=0.73 run=2 blk=0 avail=7330 (62.5%) swpO=0 conn=2 myRSS=1999 php=2 phpRSS=77 ap=42 tcp=36 topuser=evolution 2026-08-18 13:57:52 L1=0.73 run=1 blk=0 avail=7336 (62.5%) swpO=0 conn=3 myRSS=1999 php=1 phpRSS=39 ap=42 tcp=34 topuser=evolution 2026-08-18 13:58:01 L1=0.69 run=1 blk=0 avail=7346 (62.6%) swpO=0 conn=3 myRSS=1999 php=2 phpRSS=106 ap=34 tcp=41 topuser=evolution 2026-08-18 13:58:02 L1=0.69 run=2 blk=0 avail=7345 (62.6%) swpO=0 conn=3 myRSS=1999 php=3 phpRSS=138 ap=34 tcp=38 topuser=evolution 2026-08-18 13:58:11 L1=0.67 run=1 blk=0 avail=7388 (63.0%) swpO=0 conn=3 myRSS=1999 php=1 phpRSS=39 ap=34 tcp=39 topuser=evolution 2026-08-18 13:58:12 L1=0.67 run=1 blk=0 avail=7387 (63.0%) swpO=0 conn=3 myRSS=1999 php=1 phpRSS=39 ap=34 tcp=39 topuser=evolution 2026-08-18 13:58:21 L1=0.89 run=2 blk=0 avail=7109 (60.6%) swpO=0 conn=3 myRSS=1999 php=3 phpRSS=380 ap=33 tcp=37 topuser=corpkicks 2026-08-18 13:58:22 L1=0.89 run=3 blk=0 avail=7075 (60.3%) swpO=0 conn=3 myRSS=1999 php=3 phpRSS=413 ap=33 tcp=37 topuser=corpkicks 2026-08-18 13:58:31 L1=0.90 run=5 blk=0 avail=6951 (59.3%) swpO=0 conn=3 myRSS=1999 php=3 phpRSS=518 ap=35 tcp=46 topuser=corpkicks 2026-08-18 13:58:32 L1=0.90 run=3 blk=0 avail=7367 (62.8%) swpO=0 conn=3 myRSS=1999 php=1 phpRSS=39 ap=35 tcp=46 topuser=evolution 2026-08-18 13:58:41 L1=0.76 run=2 blk=0 avail=7079 (60.4%) swpO=0 conn=3 myRSS=1999 php=2 phpRSS=273 ap=49 tcp=51 topuser=madalice 2026-08-18 13:58:42 L1=0.76 run=1 blk=0 avail=7278 (62.1%) swpO=0 conn=3 myRSS=1999 php=1 phpRSS=39 ap=49 tcp=49 topuser=evolution 2026-08-18 13:58:51 L1=0.81 run=3 blk=0 avail=7064 (60.2%) swpO=0 conn=3 myRSS=1999 php=3 phpRSS=276 ap=53 tcp=54 topuser=madalice 2026-08-18 13:58:52 L1=0.81 run=6 blk=0 avail=7037 (60.0%) swpO=0 conn=3 myRSS=1999 php=2 phpRSS=274 ap=53 tcp=52 topuser=madalice 2026-08-18 13:59:01 L1=0.76 run=4 blk=0 avail=7219 (61.5%) swpO=3 conn=2 myRSS=2000 php=2 phpRSS=62 ap=53 tcp=38 topuser=evolution 2026-08-18 13:59:02 L1=0.76 run=3 blk=0 avail=7231 (61.7%) swpO=3 conn=2 myRSS=2000 php=1 phpRSS=67 ap=53 tcp=43 topuser=evolution 2026-08-18 13:59:12 L1=0.87 run=1 blk=0 avail=7084 (60.4%) swpO=0 conn=2 myRSS=2000 php=2 phpRSS=300 ap=44 tcp=44 topuser=corpkicks 2026-08-18 13:59:12 L1=0.87 run=1 blk=0 avail=7095 (60.5%) swpO=0 conn=2 myRSS=2000 php=1 phpRSS=260 ap=44 tcp=44 topuser=corpkicks 2026-08-18 13:59:22 L1=0.98 run=2 blk=0 avail=7334 (62.5%) swpO=0 conn=2 myRSS=2000 php=2 phpRSS=105 ap=36 tcp=42 topuser=evolution 2026-08-18 13:59:22 L1=0.98 run=5 blk=0 avail=7299 (62.2%) swpO=0 conn=2 myRSS=2000 php=2 phpRSS=141 ap=36 tcp=43 topuser=olympic 2026-08-18 13:59:32 L1=0.83 run=1 blk=0 avail=7376 (62.9%) swpO=0 conn=2 myRSS=2000 php=1 phpRSS=39 ap=36 tcp=39 topuser=evolution 2026-08-18 13:59:32 L1=0.83 run=1 blk=0 avail=7388 (63.0%) swpO=0 conn=2 myRSS=2000 php=0 phpRSS=0 ap=36 tcp=38 topuser=- 2026-08-18 13:59:42 L1=0.78 run=2 blk=0 avail=7210 (61.5%) swpO=0 conn=2 myRSS=2000 php=2 phpRSS=233 ap=36 tcp=52 topuser=madalice 2026-08-18 13:59:42 L1=0.78 run=2 blk=0 avail=7162 (61.1%) swpO=0 conn=2 myRSS=2000 php=1 phpRSS=256 ap=36 tcp=44 topuser=madalice 2026-08-18 13:59:52 L1=0.82 run=1 blk=0 avail=7349 (62.7%) swpO=0 conn=2 myRSS=2000 php=0 phpRSS=0 ap=41 tcp=140 topuser=- 2026-08-18 13:59:52 L1=0.82 run=2 blk=0 avail=7348 (62.7%) swpO=0 conn=2 myRSS=2000 php=0 phpRSS=0 ap=45 tcp=141 topuser=- 2026-08-18 14:00:02 L1=0.78 run=15 blk=0 avail=5689 (48.5%) swpO=0 conn=14 myRSS=2000 php=15 phpRSS=1301 ap=153 tcp=133 topuser=madalice 2026-08-18 14:00:02 L1=0.78 run=15 blk=0 avail=5440 (46.4%) swpO=0 conn=16 myRSS=2000 php=15 phpRSS=1611 ap=152 tcp=126 topuser=madalice