INCIDENT 2026-08-19 09:24:17 trigger: php_rss=1723MB mysql_conn=15 ================================================================== load: 4.57 3.63 3.05 13/676 2443787 ncpu:10 mem_avail: 5021MB/11729MB (42.8%) swap_used:2337MB swapout:0/s blocked(D):0 running:12 iowait:0.2% steal:0.0% php: 14 procs / 1723MB heaviest user: madalice (13 procs, 1653MB) apache: 45 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2527 madalice 13 1699 root 252 959 nobody 44 787 mailman 20 322 netdata 8 250 evolution 8 128 cpanellogin 1 64 named 1 45 mailnull 2 27 dovenull 6 25 wp-toolkit 6 17 zabbix 1 13 alison 1 13 aaa 1 13 lowrange 1 11 kurri 1 11 dovecot 3 6 nscd 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 13 1709 evolution 2 109 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5292 MB Active(file): 3812 MB Inactive(file): 682 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 400 MB CommitLimit: 9960 MB Committed_AS: 9673 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2064673 root 08:13:02 2196 /usr/bin/imunify-agent-proxy 2441168 root 02:02 60580 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2587804 10.3 Ssl 4-01:33:41 /usr/sbin/mariadbd 1220 1 netdata 202956 2.5 Ssl 50-23:14:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2443720 2439070 madalice 184580 54.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2122938 2112450 root 184144 0.0 S 06:45:49 spamd child 2443722 2441500 madalice 183156 51.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443723 2437905 madalice 182540 52.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443719 2438438 madalice 181928 55.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443721 2437032 madalice 181620 52.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 166876 0.0 Ss 4-01:33:44 /usr/lib/systemd/systemd-journald 2122939 2112450 root 144688 0.0 S 06:45:49 spamd child 2443750 2443742 madalice 126308 95.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443744 2440409 madalice 124776 97.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443748 2443470 madalice 122204 94.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443751 2440343 madalice 121708 89.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443749 2443741 madalice 116380 93.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443752 2443733 madalice 114916 84.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443754 2443522 madalice 110348 79.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2443740 2441663 evolution 72512 10.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2443757 2441659 madalice 69340 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2112450 1 root 68592 0.0 Ss 07:00:45 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2434034 1353308 cpanellogin 65732 0.1 S 08:37 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2441168 1 root 60580 1.1 Ssl 02:02 /opt/imunify360/venv/bin/python3 -m imav.run 2107664 1 named 46688 0.0 Ssl 07:01:37 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2223 1201 root 45152 0.0 Sl 50-23:14:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2443824 2443815 madalice 42368 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 41712 0.0 Ss 28-06:42:53 cpsrvd (SSL) - waiting for connections 1469 1 root 40540 0.1 Ss 50-23:14:22 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2443779 2439067 evolution 39476 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 32116 0.1 Sl 50-23:14:18 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1463 1 root 25556 0.0 Ss 50-23:14:22 tailwatchd 2111676 1 root 24340 0.0 Ss 07:01:15 lfd - sleeping 2437077 1276780 nobody 22128 0.0 S 05:39 /usr/sbin/httpd -k start 2437905 1276780 nobody 22060 0.3 S 04:59 /usr/sbin/httpd -k start 2437033 1276780 nobody 21656 0.0 S 05:41 /usr/sbin/httpd -k start 2440471 1276780 nobody 21528 0.1 S 02:22 /usr/sbin/httpd -k start 2439070 1276780 nobody 21464 0.0 S 04:01 /usr/sbin/httpd -k start 2437889 1276780 nobody 21320 0.0 S 05:00 /usr/sbin/httpd -k start 2437032 1276780 nobody 21164 0.0 S 05:41 /usr/sbin/httpd -k start 2440409 1276780 nobody 20972 0.1 S 02:23 /usr/sbin/httpd -k start 2440412 1276780 nobody 20948 0.0 S 02:23 /usr/sbin/httpd -k start 2439544 1276780 nobody 20916 0.0 S 03:28 /usr/sbin/httpd -k start 2441659 1276780 nobody 20916 0.2 S 01:40 /usr/sbin/httpd -k start 2440468 1276780 nobody 20836 0.0 S 02:22 /usr/sbin/httpd -k start 2439067 1276780 nobody 20784 0.0 S 04:01 /usr/sbin/httpd -k start 2441586 1276780 nobody 20596 0.1 S 01:43 /usr/sbin/httpd -k start 2440343 1276780 nobody 20440 0.0 S 02:30 /usr/sbin/httpd -k start 2439575 1276780 nobody 20420 0.0 S 03:26 /usr/sbin/httpd -k start 2441721 1276780 nobody 20192 0.0 S 01:39 /usr/sbin/httpd -k start 2438438 1276780 nobody 20172 0.0 S 04:26 /usr/sbin/httpd -k start 2441711 1276780 nobody 20040 0.0 S 01:39 /usr/sbin/httpd -k start 2441712 1276780 nobody 19924 0.1 S 01:39 /usr/sbin/httpd -k start 2441664 1276780 nobody 19616 0.0 S 01:40 /usr/sbin/httpd -k start 2441500 1276780 nobody 19436 0.0 S 01:48 /usr/sbin/httpd -k start 2440379 1276780 nobody 19024 0.0 S 02:25 /usr/sbin/httpd -k start 2439864 1276780 nobody 18944 0.0 S 03:08 /usr/sbin/httpd -k start 2443488 1276780 nobody 18884 0.1 S 00:19 /usr/sbin/httpd -k start 2111816 2111790 mailman 18616 0.0 S 07:01:14 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 2441717 1276780 nobody 18412 0.0 S 01:39 /usr/sbin/httpd -k start 2111817 2111790 mailman 18404 0.0 S 07:01:14 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 2111818 2111790 mailman 18212 0.0 S 07:01:14 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 11217474 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 11217473 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 704 evolution/portal.evolutionerp.com.au-ssl_log 221 madalice/madalice.com.au-ssl_log 151 whiz/whizengineering.com.au-ssl_log 129 bigdeals/bigdeals.com.au 119 bigdeals/bigdeals.com.au-ssl_log 98 alison/wp.alisonarts.com.au 97 alison/wp.alisonarts.com.au-ssl_log 55 corpkicks/corporatekicks.com.au-ssl_log 11 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 424 203.54.180.238 200 103.104.165.99 152 20.24.67.246 129 20.196.200.88 119 74.249.206.207 98 74.248.133.44 95 180.181.236.49 83 185.177.72.70 62 103.104.164.114 59 120.150.225.142 45 40.74.68.220 34 150.228.163.144 17 1.145.73.14 16 182.239.240.254 15 150.228.151.51 --- top request paths across all vhosts (last 3 min) --- 238 POST /functions.php 161 GET /app/ajax.php 81 GET /factory_session_checker.php 59 GET /cgi-sys/suspendedpage.cgi 55 GET /heartbeat.php 53 GET /index.php 42 GET /factory_session_processed_qty.php 42 GET /factory_session_joiner.php 32 POST /app/ajax.php 28 POST /clienteditsave.php 28 POST /app/ajax/selectFilterSingle.php 27 POST /plugins/csvexporter/plugin.php 22 POST /quoteditsave.php 20 POST /app/ajax/selectFilter.php 14 POST /wp-admin/admin-ajax.php 12 POST //functions.php 11 POST /itemModify.php 10 POST /purchaseaddsave.php 10 POST /logsave.php 8 GET /admin.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 238 POST /functions.php 161 GET /app/ajax.php 53 GET /index.php 32 POST /app/ajax.php 28 POST /clienteditsave.php 28 POST /app/ajax/selectFilterSingle.php 27 POST /plugins/csvexporter/plugin.php 22 POST /quoteditsave.php 20 POST /app/ajax/selectFilter.php 12 POST //functions.php 11 POST /itemModify.php 10 POST /purchaseaddsave.php -- last 10 requests -- 203.54.180.238 - - [19/Aug/2026:09:24:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29393&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [19/Aug/2026:09:24:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 180.181.236.49 - - [19/Aug/2026:09:24:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2799&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [19/Aug/2026:09:24:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29330&tab=jobeditmf" "Mozilla/5.0 (Windows NT 10.0; Win64; x 1.145.73.14 - - [19/Aug/2026:09:24:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36712" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 103.104.165.99 - - [19/Aug/2026:09:24:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=16319" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 180.181.236.49 - - [19/Aug/2026:09:24:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6924" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [19/Aug/2026:09:24:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78044" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 120.150.225.142 - - [19/Aug/2026:09:24:19 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=1155" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [19/Aug/2026:09:24:19 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 81 GET /factory_session_checker.php 55 GET /heartbeat.php 42 GET /factory_session_processed_qty.php 42 GET /factory_session_joiner.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [19/Aug/2026:09:24:06 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:09:24:09 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:09:24:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:09:24:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:09:24:11 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:09:24:12 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 129 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [19/Aug/2026:09:24:12 +1000] "GET /factory_session_joiner.php?id=34697 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [19/Aug/2026:09:24:11 +1000] "GET /heartbeat.php?sentAt=1787095450&bytes=106,132,233,154&_=1787088569062 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:09:24:12 +1000] "GET /heartbeat.php?sentAt=1787095452&bytes=106,132,233,156&_=1787092227510 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:09:24:12 +1000] "GET /heartbeat.php?sentAt=1787095452&bytes=106,132,233,156&_=1787056652151 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == madalice/madalice.com.au-ssl_log == -- top paths -- 6 POST /wp-admin/admin-ajax.php 4 POST / 4 GET /store/custom-afl-carlton-kids/ 2 GET / 1 GET /w.php 1 GET /wp-content/plugins/pods/readme.txt 1 GET /wp-content/plugins/pods/init.php 1 GET /wp-content/debug%2elog 1 GET /wp-config.php 1 GET /wp-admin.php 1 GET /wp-admin/includes/colour.php 1 GET /wp-admin/includes/about.php -- last 10 requests -- 40.74.68.220 - - [19/Aug/2026:09:24:05 +1000] "GET /wp-admin/images/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 40.74.68.220 - - [19/Aug/2026:09:24:07 +1000] "GET /wp-admin/includes/ HTTP/1.1" 200 1907 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 114.119.143.14 - - [19/Aug/2026:09:24:05 +1000] "GET /store/custom-afl-carlton-kids/?rating=1&verified=1&wcpr_image=1&wcpr_rating=3 HTTP/1.1" 404 30582 "https://madalice.com.au/store/custom-afl-carlton-kids/?rating=1&ver 185.177.72.70 - - [19/Aug/2026:09:24:07 +1000] "GET /%2fbackend%2f%2eenv HTTP/1.1" 404 30574 "-" "curl/8.7.1" 40.74.68.220 - - [19/Aug/2026:09:24:07 +1000] "GET /wp-admin/includes/about.php HTTP/1.1" 404 30571 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 40.74.68.220 - - [19/Aug/2026:09:24:10 +1000] "GET /wp-admin/includes/colour.php HTTP/1.1" 404 30572 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.177.72.70 - - [19/Aug/2026:09:24:13 +1000] "GET /web/.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 154.71.139.156 - - [19/Aug/2026:09:24:11 +1000] "GET /store/adidas-samba-gold-glitter/ HTTP/1.1" 200 46411 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safa 83.194.217.174 - - [19/Aug/2026:09:24:11 +1000] "GET /store/monsters-custom-af1/ HTTP/1.1" 200 46170 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537 103.174.206.73 - - [19/Aug/2026:09:24:11 +1000] "GET /store/pink-cartoon-custom-adidas-samba/ HTTP/1.1" 200 47461 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0 --- last 30 samples (run-up to this incident) --- 2026-08-19 09:21:55 L1=3.45 run=16 blk=0 avail=5066 (43.2%) swpO=534 conn=16 myRSS=2545 php=18 phpRSS=1732 ap=63 tcp=73 topuser=madalice 2026-08-19 09:21:56 L1=3.45 run=26 blk=0 avail=4485 (38.2%) swpO=860 conn=15 myRSS=2540 php=21 phpRSS=2384 ap=79 tcp=74 topuser=madalice 2026-08-19 09:22:07 L1=4.50 run=4 blk=0 avail=6095 (52.0%) swpO=706 conn=15 myRSS=2525 php=3 phpRSS=230 ap=69 tcp=50 topuser=madalice 2026-08-19 09:22:08 L1=4.38 run=8 blk=0 avail=5668 (48.3%) swpO=848 conn=16 myRSS=2525 php=5 phpRSS=729 ap=69 tcp=40 topuser=madalice 2026-08-19 09:22:17 L1=4.03 run=3 blk=0 avail=6043 (51.5%) swpO=0 conn=3 myRSS=2525 php=2 phpRSS=247 ap=59 tcp=48 topuser=madalice 2026-08-19 09:22:18 L1=3.87 run=4 blk=0 avail=6042 (51.5%) swpO=0 conn=16 myRSS=2525 php=3 phpRSS=295 ap=58 tcp=43 topuser=madalice 2026-08-19 09:22:27 L1=3.72 run=6 blk=0 avail=5916 (50.4%) swpO=0 conn=3 myRSS=2525 php=9 phpRSS=647 ap=51 tcp=59 topuser=madalice 2026-08-19 09:22:28 L1=3.82 run=8 blk=0 avail=5808 (49.5%) swpO=0 conn=16 myRSS=2525 php=9 phpRSS=757 ap=51 tcp=55 topuser=madalice 2026-08-19 09:22:37 L1=3.99 run=4 blk=0 avail=6061 (51.7%) swpO=0 conn=3 myRSS=2525 php=3 phpRSS=237 ap=64 tcp=75 topuser=madalice 2026-08-19 09:22:38 L1=3.99 run=6 blk=0 avail=5697 (48.6%) swpO=0 conn=16 myRSS=2525 php=6 phpRSS=659 ap=72 tcp=74 topuser=madalice 2026-08-19 09:22:47 L1=3.53 run=4 blk=0 avail=5751 (49.0%) swpO=0 conn=3 myRSS=2525 php=3 phpRSS=464 ap=81 tcp=53 topuser=madalice 2026-08-19 09:22:48 L1=3.53 run=2 blk=0 avail=6053 (51.6%) swpO=0 conn=16 myRSS=2525 php=1 phpRSS=100 ap=80 tcp=47 topuser=madalice 2026-08-19 09:22:57 L1=3.46 run=11 blk=0 avail=5764 (49.1%) swpO=0 conn=3 myRSS=2525 php=5 phpRSS=518 ap=71 tcp=55 topuser=madalice 2026-08-19 09:22:58 L1=3.46 run=3 blk=0 avail=5988 (51.1%) swpO=0 conn=2 myRSS=2525 php=2 phpRSS=102 ap=70 tcp=53 topuser=madalice 2026-08-19 09:23:07 L1=3.68 run=4 blk=0 avail=6037 (51.5%) swpO=0 conn=3 myRSS=2525 php=3 phpRSS=257 ap=61 tcp=55 topuser=evolution 2026-08-19 09:23:08 L1=3.68 run=3 blk=0 avail=6140 (52.4%) swpO=0 conn=2 myRSS=2525 php=3 phpRSS=150 ap=60 tcp=54 topuser=evolution 2026-08-19 09:23:17 L1=3.88 run=5 blk=0 avail=5948 (50.7%) swpO=0 conn=4 myRSS=2525 php=3 phpRSS=390 ap=53 tcp=58 topuser=madalice 2026-08-19 09:23:18 L1=3.88 run=6 blk=0 avail=5778 (49.3%) swpO=0 conn=2 myRSS=2525 php=5 phpRSS=624 ap=53 tcp=54 topuser=madalice 2026-08-19 09:23:27 L1=3.74 run=5 blk=0 avail=6022 (51.3%) swpO=0 conn=4 myRSS=2526 php=4 phpRSS=346 ap=52 tcp=58 topuser=madalice 2026-08-19 09:23:28 L1=3.74 run=4 blk=0 avail=5700 (48.6%) swpO=0 conn=2 myRSS=2526 php=4 phpRSS=676 ap=52 tcp=48 topuser=madalice 2026-08-19 09:23:37 L1=3.85 run=4 blk=0 avail=6043 (51.5%) swpO=0 conn=4 myRSS=2526 php=3 phpRSS=317 ap=50 tcp=48 topuser=madalice 2026-08-19 09:23:38 L1=3.85 run=8 blk=0 avail=6007 (51.2%) swpO=0 conn=2 myRSS=2526 php=5 phpRSS=385 ap=52 tcp=53 topuser=madalice 2026-08-19 09:23:47 L1=3.72 run=2 blk=0 avail=6308 (53.8%) swpO=0 conn=4 myRSS=2526 php=0 phpRSS=0 ap=47 tcp=42 topuser=- 2026-08-19 09:23:49 L1=3.72 run=3 blk=0 avail=6225 (53.1%) swpO=0 conn=2 myRSS=2526 php=2 phpRSS=153 ap=45 tcp=38 topuser=madalice 2026-08-19 09:23:57 L1=3.62 run=7 blk=0 avail=5511 (47.0%) swpO=0 conn=4 myRSS=2526 php=11 phpRSS=1148 ap=40 tcp=55 topuser=corpkicks 2026-08-19 09:23:59 L1=3.62 run=4 blk=0 avail=5731 (48.9%) swpO=0 conn=5 myRSS=2527 php=5 phpRSS=621 ap=46 tcp=57 topuser=corpkicks 2026-08-19 09:24:07 L1=3.38 run=4 blk=0 avail=5927 (50.5%) swpO=0 conn=4 myRSS=2527 php=5 phpRSS=504 ap=49 tcp=59 topuser=customc 2026-08-19 09:24:09 L1=3.38 run=4 blk=1 avail=5880 (50.1%) swpO=0 conn=5 myRSS=2527 php=3 phpRSS=492 ap=49 tcp=44 topuser=madalice 2026-08-19 09:24:17 L1=4.57 run=12 blk=0 avail=5021 (42.8%) swpO=0 conn=15 myRSS=2527 php=14 phpRSS=1723 ap=45 tcp=62 topuser=madalice 2026-08-19 09:24:19 L1=4.57 run=25 blk=2 avail=4309 (36.7%) swpO=2335 conn=16 myRSS=2506 php=20 phpRSS=2749 ap=59 tcp=53 topuser=madalice