INCIDENT 2026-08-19 22:40:33 trigger: php_rss=1582MB ================================================================== load: 1.62 0.77 0.73 9/659 3063503 ncpu:10 mem_avail: 5273MB/11729MB (45.0%) swap_used:2548MB swapout:183/s blocked(D):0 running:10 iowait:0.1% steal:0.0% php: 10 procs / 1582MB heaviest user: madalice (8 procs, 1385MB) apache: 40 procs tcp_estab: 30 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2703 madalice 8 1429 root 241 674 nobody 39 638 netdata 8 260 tubesupplies 1 156 mailman 20 154 cpanellogin 1 62 evolution 7 61 lowrange 3 36 dovenull 6 26 kurri 2 23 wp-toolkit 6 17 zabbix 1 16 named 1 14 aaa 1 13 vinesit 1 12 alison 1 11 mailnull 1 7 dovecot 3 6 --- php workers by user --- USER PROCS RSS_MB madalice 8 1439 tubesupplies 1 156 evolution 1 40 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5437 MB Active(file): 2628 MB Inactive(file): 1987 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 402 MB CommitLimit: 9960 MB Committed_AS: 8745 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2064673 root 21:29:18 2052 /usr/bin/imunify-agent-proxy 3063098 root 00:33 3036 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2768252 11.0 Ssl 4-14:49:57 /usr/sbin/mariadbd 3063443 3060819 madalice 266892 74.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3063442 3063402 madalice 260432 75.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3063460 3063436 madalice 246732 71.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 205708 2.5 Ssl 51-12:30:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3063470 3063408 madalice 187344 80.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3063468 3063324 madalice 179872 84.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2122939 2112450 root 178108 0.0 S 20:02:05 spamd child 3063469 3063427 madalice 169744 81.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3063338 3062500 tubesupplies 160320 9.4 S 00:14 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3063473 3063401 madalice 108592 77.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3063474 3063409 madalice 99732 73.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3048743 1353308 cpanellogin 63548 0.0 S 24:52 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2112450 1 root 60748 0.0 Ss 20:17:01 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2661802 2112450 root 58312 0.0 S 09:26:18 spamd child 2575382 1 root 51232 0.0 Ss 4-14:50:00 /usr/lib/systemd/systemd-journald 2223 1201 root 50392 0.0 Sl 51-12:30:38 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42108 0.0 Ss 28-19:59:09 cpsrvd (SSL) - waiting for connections 3063472 3050346 evolution 41128 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 37896 0.1 Sl 51-12:30:34 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3063471 1353308 root 33140 0.0 S 00:02 cpsrvd (SSL) - waiting for connections 1469 1 root 30768 0.1 Ss 51-12:30:38 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3057900 1276780 nobody 23468 0.0 S 09:59 /usr/sbin/httpd -k start 3050346 1276780 nobody 22644 0.0 S 22:14 /usr/sbin/httpd -k start 3056450 1276780 nobody 22328 0.0 S 12:10 /usr/sbin/httpd -k start 3058561 1276780 nobody 21996 0.0 S 08:49 /usr/sbin/httpd -k start 3060819 1276780 nobody 21732 0.0 S 03:55 /usr/sbin/httpd -k start 3058560 1276780 nobody 21720 0.0 S 08:49 /usr/sbin/httpd -k start 3060796 1276780 nobody 21312 0.0 S 03:58 /usr/sbin/httpd -k start 3062499 1276780 nobody 21236 0.0 S 01:32 /usr/sbin/httpd -k start 3058899 1276780 nobody 21220 0.0 S 07:59 /usr/sbin/httpd -k start 3059150 1276780 nobody 20668 0.0 S 07:19 /usr/sbin/httpd -k start 3062432 1276780 nobody 19424 0.0 S 01:33 /usr/sbin/httpd -k start 3063408 1276780 nobody 19308 0.3 S 00:09 /usr/sbin/httpd -k start 3063402 1276780 nobody 19236 0.3 S 00:10 /usr/sbin/httpd -k start 3063401 1276780 nobody 19168 0.3 S 00:10 /usr/sbin/httpd -k start 3063409 1276780 nobody 18176 0.1 S 00:09 /usr/sbin/httpd -k start 3063340 1276780 nobody 18096 0.0 S 00:13 /usr/sbin/httpd -k start 3063410 1276780 nobody 18068 0.1 S 00:09 /usr/sbin/httpd -k start 3063324 1276780 nobody 17976 0.0 S 00:20 /usr/sbin/httpd -k start 3062500 1276780 nobody 17756 0.0 S 01:32 /usr/sbin/httpd -k start 1463 1 root 17444 0.0 Ss 51-12:30:38 tailwatchd 3060818 1276780 nobody 17360 0.0 S 03:55 /usr/sbin/httpd -k start 1204 1 zabbix 16892 0.2 Ssl 51-12:30:39 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3063373 1276780 nobody 16800 0.0 S 00:11 /usr/sbin/httpd -k start 3063423 1276780 nobody 16736 0.0 S 00:08 /usr/sbin/httpd -k start 185104 2431 netdata 16648 2.1 Sl 7-02:06:57 /usr/libexec/netdata/plugins.d/apps.plugin 1 3063421 1276780 nobody 16316 0.0 S 00:08 /usr/sbin/httpd -k start 3063422 1276780 nobody 16260 0.0 S 00:08 /usr/sbin/httpd -k start 3063407 1276780 nobody 16196 0.0 S 00:09 /usr/sbin/httpd -k start 3063418 1276780 nobody 16196 0.0 S 00:08 /usr/sbin/httpd -k start 3063416 1276780 nobody 16192 0.2 S 00:08 /usr/sbin/httpd -k start 3063419 1276780 nobody 16192 0.0 S 00:08 /usr/sbin/httpd -k start 3063417 1276780 nobody 16188 0.0 S 00:08 /usr/sbin/httpd -k start 3063420 1276780 nobody 16188 0.0 S 00:08 /usr/sbin/httpd -k start 2111676 1 root 15940 0.0 Ss 20:17:31 lfd - sleeping 3063427 1276780 nobody 15888 0.0 S 00:06 /usr/sbin/httpd -k start 3063435 1276780 nobody 15880 0.0 S 00:05 /usr/sbin/httpd -k start 3063436 1276780 nobody 15808 0.0 S 00:05 /usr/sbin/httpd -k start 2107664 1 named 15248 0.0 Ssl 20:17:53 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14492674 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 14492663 | madalice_wp | madalice_wp | Query | 0 | Opening tables | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (30661) ORDER BY meta_id ASC | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 54 evolution/portal.evolutionerp.com.au-ssl_log 24 evolution/staging.evolutionerp.com.au-ssl_log 18 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 32 20.100.185.105 24 203.54.180.238 18 85.204.70.116 16 35.196.244.246 2 66.249.73.171 2 2a10:3c0:100:0:1:37:0:5 1 45.156.129.97 1 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 3 GET / 1 POST /wp-admin/admin-ajax.php 1 POST /mcp 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /yindu.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /xmlrpc.php 1 GET //xmlrpc.php 1 GET //wp/wp-includes/wlwmanifest.xml 1 GET /wp-json 1 GET //wp-includes/wlwmanifest.xml 1 GET /wp-content/uploads/min.php 1 GET /wp-content.php 1 GET /wp-admin/index.php 1 GET /wp-admin/css/ 1 GET //wp2/wp-includes/wlwmanifest.xml 1 GET //wp1/wp-includes/wlwmanifest.xml 1 GET //wordpress/wp-includes/wlwmanifest.xml --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 1 POST /wp-admin/admin-ajax.php 1 POST /mcp 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /yindu.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /xmlrpc.php 1 GET /wp-json 1 GET /wp-content/uploads/min.php 1 GET /wp-content.php 1 GET /wp-admin/index.php 1 GET /wp-admin/css/ -- last 10 requests -- 35.196.244.246 - - [19/Aug/2026:22:40:28 +1000] "GET /.gitconfig HTTP/1.1" 404 30550 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.196.244.246 - - [19/Aug/2026:22:40:28 +1000] "GET /.git/HEAD HTTP/1.1" 404 30549 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.196.244.246 - - [19/Aug/2026:22:40:28 +1000] "GET /.github/workflows/deploy.yml HTTP/1.1" 404 30556 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 20.100.185.105 - - [19/Aug/2026:22:40:28 +1000] "GET /xxx.php HTTP/1.1" 404 30549 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 35.196.244.246 - - [19/Aug/2026:22:40:28 +1000] "GET /.gitlab-ci.yml HTTP/1.1" 404 30554 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.196.244.246 - - [19/Aug/2026:22:40:28 +1000] "GET /.git-credentials HTTP/1.1" 404 30554 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.196.244.246 - - [19/Aug/2026:22:40:31 +1000] "GET /.env.backup HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.196.244.246 - - [19/Aug/2026:22:40:31 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.196.244.246 - - [19/Aug/2026:22:40:31 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 20.100.185.105 - - [19/Aug/2026:22:40:31 +1000] "GET /wp-content.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [19/Aug/2026:22:39:12 +1000] "GET /heartbeat.php?sentAt=1787143153&bytes=106,133,163,241&_=1787115831182 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:39:18 +1000] "GET /heartbeat.php?sentAt=1787143158&bytes=106,133,163,246&_=1787124376302 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:39:22 +1000] "GET /heartbeat.php?sentAt=1787143163&bytes=106,133,163,251&_=1787115831183 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:39:28 +1000] "GET /heartbeat.php?sentAt=1787143168&bytes=106,133,164,0&_=1787124376303 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [19/Aug/2026:22:39:32 +1000] "GET /heartbeat.php?sentAt=1787143173&bytes=106,133,164,5&_=1787115831184 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [19/Aug/2026:22:39:38 +1000] "GET /heartbeat.php?sentAt=1787143178&bytes=106,133,164,10&_=1787124376304 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [19/Aug/2026:22:39:42 +1000] "GET /heartbeat.php?sentAt=1787143183&bytes=106,133,164,15&_=1787115831185 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [19/Aug/2026:22:39:48 +1000] "GET /heartbeat.php?sentAt=1787143188&bytes=106,133,164,20&_=1787124376305 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [19/Aug/2026:22:39:52 +1000] "GET /heartbeat.php?sentAt=1787143193&bytes=106,133,164,25&_=1787115831186 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [19/Aug/2026:22:39:58 +1000] "GET /heartbeat.php?sentAt=1787143198&bytes=106,133,164,30&_=1787124376306 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == evolution/staging.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET / 1 GET //xmlrpc.php 1 GET //wp/wp-includes/wlwmanifest.xml 1 GET //wp-includes/wlwmanifest.xml 1 GET //wp2/wp-includes/wlwmanifest.xml 1 GET //wp1/wp-includes/wlwmanifest.xml 1 GET //wordpress/wp-includes/wlwmanifest.xml 1 GET //web/wp-includes/wlwmanifest.xml 1 GET //website/wp-includes/wlwmanifest.xml 1 GET //test/wp-includes/wlwmanifest.xml 1 GET //site/wp-includes/wlwmanifest.xml 1 GET //shop/wp-includes/wlwmanifest.xml -- last 10 requests -- 85.204.70.116 - - [19/Aug/2026:22:38:47 +1000] "GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.3 85.204.70.116 - - [19/Aug/2026:22:38:47 +1000] "GET //news/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 85.204.70.116 - - [19/Aug/2026:22:38:47 +1000] "GET //2018/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 85.204.70.116 - - [19/Aug/2026:22:38:48 +1000] "GET //2019/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 85.204.70.116 - - [19/Aug/2026:22:38:48 +1000] "GET //shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 85.204.70.116 - - [19/Aug/2026:22:38:48 +1000] "GET //wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 85.204.70.116 - - [19/Aug/2026:22:38:49 +1000] "GET //test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 85.204.70.116 - - [19/Aug/2026:22:38:49 +1000] "GET //media/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/53 85.204.70.116 - - [19/Aug/2026:22:38:49 +1000] "GET //wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 85.204.70.116 - - [19/Aug/2026:22:38:50 +1000] "GET //site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 --- last 30 samples (run-up to this incident) --- 2026-08-19 22:38:10 L1=0.32 run=3 blk=0 avail=6536 (55.7%) swpO=0 conn=2 myRSS=2707 php=2 phpRSS=209 ap=18 tcp=29 topuser=tubesupplies 2026-08-19 22:38:13 L1=0.46 run=2 blk=0 avail=6328 (54.0%) swpO=0 conn=4 myRSS=2707 php=3 phpRSS=456 ap=18 tcp=28 topuser=madalice 2026-08-19 22:38:21 L1=0.42 run=1 blk=0 avail=6570 (56.0%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=156 ap=16 tcp=25 topuser=tubesupplies 2026-08-19 22:38:23 L1=0.39 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=4 myRSS=2707 php=2 phpRSS=196 ap=15 tcp=26 topuser=tubesupplies 2026-08-19 22:38:31 L1=0.36 run=1 blk=0 avail=6577 (56.1%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=156 ap=15 tcp=25 topuser=tubesupplies 2026-08-19 22:38:33 L1=0.33 run=1 blk=0 avail=6567 (56.0%) swpO=0 conn=4 myRSS=2707 php=2 phpRSS=196 ap=15 tcp=26 topuser=tubesupplies 2026-08-19 22:38:41 L1=0.38 run=1 blk=0 avail=6584 (56.1%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=156 ap=15 tcp=22 topuser=tubesupplies 2026-08-19 22:38:43 L1=0.35 run=1 blk=0 avail=6570 (56.0%) swpO=0 conn=4 myRSS=2707 php=2 phpRSS=196 ap=15 tcp=26 topuser=tubesupplies 2026-08-19 22:38:51 L1=0.32 run=1 blk=0 avail=6581 (56.1%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=156 ap=15 tcp=23 topuser=tubesupplies 2026-08-19 22:38:53 L1=0.30 run=1 blk=0 avail=6570 (56.0%) swpO=0 conn=4 myRSS=2707 php=2 phpRSS=196 ap=15 tcp=23 topuser=tubesupplies 2026-08-19 22:39:01 L1=0.35 run=4 blk=0 avail=6232 (53.1%) swpO=0 conn=2 myRSS=2707 php=4 phpRSS=595 ap=16 tcp=30 topuser=corpkicks 2026-08-19 22:39:03 L1=0.72 run=5 blk=0 avail=5901 (50.3%) swpO=0 conn=4 myRSS=2707 php=8 phpRSS=968 ap=18 tcp=36 topuser=evolution 2026-08-19 22:39:11 L1=0.67 run=1 blk=0 avail=6687 (57.0%) swpO=0 conn=2 myRSS=2707 php=0 phpRSS=0 ap=18 tcp=22 topuser=- 2026-08-19 22:39:13 L1=0.61 run=2 blk=0 avail=6564 (56.0%) swpO=0 conn=3 myRSS=2707 php=2 phpRSS=195 ap=17 tcp=25 topuser=madalice 2026-08-19 22:39:21 L1=0.64 run=2 blk=0 avail=6594 (56.2%) swpO=1 conn=2 myRSS=2707 php=1 phpRSS=145 ap=18 tcp=26 topuser=madalice 2026-08-19 22:39:23 L1=0.67 run=2 blk=0 avail=6627 (56.5%) swpO=1 conn=3 myRSS=2707 php=2 phpRSS=132 ap=18 tcp=26 topuser=madalice 2026-08-19 22:39:31 L1=0.70 run=2 blk=0 avail=6663 (56.8%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=58 ap=18 tcp=25 topuser=madalice 2026-08-19 22:39:33 L1=0.72 run=2 blk=0 avail=6450 (55.0%) swpO=0 conn=3 myRSS=2707 php=2 phpRSS=302 ap=18 tcp=23 topuser=madalice 2026-08-19 22:39:41 L1=0.75 run=2 blk=0 avail=6466 (55.1%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=208 ap=18 tcp=22 topuser=madalice 2026-08-19 22:39:43 L1=0.85 run=4 blk=0 avail=6448 (55.0%) swpO=0 conn=3 myRSS=2707 php=3 phpRSS=286 ap=17 tcp=24 topuser=madalice 2026-08-19 22:39:51 L1=1.02 run=3 blk=0 avail=6596 (56.2%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=139 ap=17 tcp=22 topuser=madalice 2026-08-19 22:39:53 L1=1.02 run=2 blk=0 avail=6626 (56.5%) swpO=0 conn=3 myRSS=2707 php=2 phpRSS=130 ap=17 tcp=24 topuser=madalice 2026-08-19 22:40:01 L1=1.02 run=6 blk=1 avail=6627 (56.5%) swpO=0 conn=2 myRSS=2707 php=1 phpRSS=78 ap=17 tcp=28 topuser=madalice 2026-08-19 22:40:03 L1=1.02 run=1 blk=0 avail=6658 (56.8%) swpO=0 conn=3 myRSS=2707 php=1 phpRSS=40 ap=17 tcp=28 topuser=evolution 2026-08-19 22:40:11 L1=0.93 run=4 blk=0 avail=6139 (52.3%) swpO=0 conn=2 myRSS=2707 php=4 phpRSS=667 ap=18 tcp=26 topuser=madalice 2026-08-19 22:40:13 L1=1.02 run=2 blk=0 avail=6535 (55.7%) swpO=0 conn=3 myRSS=2707 php=2 phpRSS=205 ap=18 tcp=25 topuser=madalice 2026-08-19 22:40:21 L1=1.02 run=2 blk=0 avail=6185 (52.7%) swpO=0 conn=2 myRSS=2707 php=3 phpRSS=580 ap=20 tcp=26 topuser=madalice 2026-08-19 22:40:23 L1=1.02 run=8 blk=0 avail=5690 (48.5%) swpO=0 conn=3 myRSS=2707 php=10 phpRSS=1276 ap=21 tcp=42 topuser=madalice 2026-08-19 22:40:31 L1=1.50 run=4 blk=0 avail=6273 (53.5%) swpO=183 conn=2 myRSS=2703 php=3 phpRSS=271 ap=42 tcp=40 topuser=tubesupplies 2026-08-19 22:40:33 L1=1.62 run=10 blk=0 avail=5273 (45.0%) swpO=183 conn=11 myRSS=2703 php=10 phpRSS=1582 ap=40 tcp=30 topuser=madalice