INCIDENT 2026-08-21 18:15:34 trigger: swapout=5684/s php_procs=25 php_rss=4020MB mysql_conn=26 ================================================================== load: 6.00 2.22 1.27 29/732 1034082 ncpu:10 mem_avail: 3023MB/11729MB (25.8%) swap_used:3089MB swapout:5684/s blocked(D):0 running:35 iowait:1.6% steal:0.0% php: 25 procs / 4020MB heaviest user: madalice (24 procs, 3852MB) apache: 102 procs tcp_estab: 63 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 24 3979 mysql 1 2925 nobody 101 1270 root 241 869 netdata 8 237 mailman 20 94 evolution 8 29 dovenull 6 26 mailnull 3 21 wp-toolkit 6 18 cpanellogin 1 18 zabbix 1 14 named 1 13 lowrange 1 12 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 24 3990 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4751 MB Active(file): 1521 MB Inactive(file): 1100 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 423 MB CommitLimit: 9960 MB Committed_AS: 12326 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 17:04:18 2544 /usr/bin/imunify-agent-proxy 1024421 root 15:34 1200 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2995456 11.7 Ssl 6-10:24:59 /usr/sbin/mariadbd 1033948 1033045 madalice 265036 46.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033974 1033959 madalice 264820 47.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033971 1033954 madalice 264684 49.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033978 1033963 madalice 225212 42.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033969 1033958 madalice 211204 45.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033966 1033952 madalice 207880 41.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033970 1033955 madalice 203648 41.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033967 1033953 madalice 198724 41.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 187276 2.5 Ssl 53-08:05:41 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1033976 1033961 madalice 185160 39.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033968 1033956 madalice 182668 34.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033965 1033951 madalice 180784 34.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 319521 311538 root 174172 0.0 S 15:37:50 spamd child 1033980 1030141 madalice 171152 42.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033973 1033957 madalice 159632 30.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033977 1033962 madalice 159368 28.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1034014 1033826 madalice 158512 34.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033975 1033960 madalice 158308 31.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 853881 311538 root 150788 0.0 S 04:24:45 spamd child 2575382 1 root 150184 0.0 Ss 6-10:25:02 /usr/lib/systemd/systemd-journald 1034018 1033772 madalice 139536 32.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1033979 1033964 madalice 139524 24.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1034019 1033920 madalice 135480 40.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1034015 1033709 madalice 131376 28.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1034017 1033657 madalice 127668 30.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1034020 1033696 madalice 122584 35.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1034022 1033925 madalice 111804 46.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1034016 1033377 madalice 102864 22.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 311538 1 root 95484 0.0 Ss 15:52:49 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2223 1201 root 42576 0.0 Sl 53-08:05:40 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41756 0.0 Ss 30-15:34:11 cpsrvd (SSL) - waiting for connections 1469 1 root 33860 0.1 Ss 53-08:05:40 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 31260 0.1 Sl 53-08:05:36 /usr/libexec/netdata/plugins.d/go.d.plugin 1 310731 1 root 20852 0.0 Ss 15:53:21 lfd - sleeping 1463 1 root 19964 0.0 Ss 53-08:05:40 tailwatchd 1033709 1276780 nobody 19540 0.0 S 00:25 /usr/sbin/httpd -k start 1029244 1353308 cpanellogin 19076 0.0 S 07:02 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1033705 1276780 nobody 18912 0.0 S 00:25 /usr/sbin/httpd -k start 1033685 1276780 nobody 18788 0.0 S 00:27 /usr/sbin/httpd -k start 185104 2431 netdata 17712 2.1 Sl 8-21:41:59 /usr/libexec/netdata/plugins.d/apps.plugin 1 1033806 1276780 nobody 17620 0.0 S 00:20 /usr/sbin/httpd -k start 1033699 1276780 nobody 17576 0.0 S 00:26 /usr/sbin/httpd -k start 1033710 1276780 nobody 17568 0.0 S 00:25 /usr/sbin/httpd -k start 1033696 1276780 nobody 17560 0.0 S 00:26 /usr/sbin/httpd -k start 1033706 1276780 nobody 17544 0.0 S 00:25 /usr/sbin/httpd -k start 1033771 1276780 nobody 17468 0.0 S 00:21 /usr/sbin/httpd -k start 1033926 1276780 nobody 17340 0.0 S 00:08 /usr/sbin/httpd -k start 1033741 1276780 nobody 17160 0.0 S 00:22 /usr/sbin/httpd -k start 1033708 1276780 nobody 17136 0.0 S 00:25 /usr/sbin/httpd -k start 1033670 1276780 nobody 16928 0.0 S 00:30 /usr/sbin/httpd -k start 1033772 1276780 nobody 16836 0.0 S 00:21 /usr/sbin/httpd -k start 1033826 1276780 nobody 16800 0.0 S 00:18 /usr/sbin/httpd -k start 1033707 1276780 nobody 16680 0.0 S 00:25 /usr/sbin/httpd -k start 1033920 1276780 nobody 16456 0.0 S 00:09 /usr/sbin/httpd -k start 1033925 1276780 nobody 16388 0.0 S 00:08 /usr/sbin/httpd -k start 1033954 1276780 nobody 16336 0.0 S 00:05 /usr/sbin/httpd -k start 1033951 1276780 nobody 16268 0.0 S 00:05 /usr/sbin/httpd -k start 1033952 1276780 nobody 16268 0.0 S 00:05 /usr/sbin/httpd -k start 1033960 1276780 nobody 16256 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 1033974 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 22939986 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 22939965 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au-ssl_log 80 alison/alisonarts.com.au-ssl_log 54 customkidscom/customkids.com.au-ssl_log 46 cosgrovecreative/cosgrovecreative.com.au 40 evolution/evolutionerp.com.au 39 evolution/evolutionerp.com.au-ssl_log 37 evolution/my.evolutionerp.com.au-ssl_log 33 evolution/portal.evolutionerp.com.au-ssl_log 30 madalice/madalice.com.au-ssl_log 27 otterfencing/otterfencing.com.au-ssl_log 23 corpkicks/corporatekicks.com.au-ssl_log 9 aaa/aaadownunder.com.au-ssl_log 4 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 80 158.158.34.183 75 168.62.48.100 53 34.23.124.185 46 20.251.48.93 40 20.151.9.151 30 203.54.180.238 23 172.191.149.99 22 147.161.213.78 15 34.139.77.106 7 120.21.110.110 5 118.127.40.55 3 20.151.109.219 3 114.119.137.101 2 52.167.144.229 2 49.182.67.78 --- top request paths across all vhosts (last 3 min) --- 30 GET /heartbeat.php 13 POST /functions.php 9 GET /index.php 6 GET /app/ajax.php 5 POST /wp-cron.php 5 GET / 4 GET /wp-head.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /store/gift-card-2/ 4 GET /rclone.conf 3 GET /wpxml.php 3 GET /wp-admin/ 3 GET /store/gift-card/ 3 GET /.git/HEAD 3 GET /.git-credentials 3 GET /.git/config 2 POST /app/ajax.php 2 GET /zoko.php 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /x.php 1 GET /xleet.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/fonts/ 1 GET /w.php 1 GET /wp-good.php -- last 10 requests -- 158.158.34.183 - - [21/Aug/2026:18:13:59 +1000] "GET /wp-includes/fonts/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:13:59 +1000] "GET /themes.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:00 +1000] "GET /cv.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:00 +1000] "GET /wp-admin/js/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:00 +1000] "GET /wp-content/uploads/index.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:00 +1000] "GET /ws83.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:01 +1000] "GET /atex1.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:01 +1000] "GET /class-t.api.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:01 +1000] "GET /w.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [21/Aug/2026:18:14:01 +1000] "GET /archive.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET / 2 GET /z9x8c7v6b5-debug-trigger-www.alisonarts.com.au 2 GET /wp-admin/ 2 GET /signin 2 GET /rclone.conf 2 GET /portal 2 GET /manage 2 GET /login 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.git/config 2 GET /dashboard -- last 10 requests -- 34.23.124.185 - - [21/Aug/2026:18:15:13 +1000] "GET /console HTTP/1.1" 404 9226 "https://www.alisonarts.com.au/console" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile S 34.23.124.185 - - [21/Aug/2026:18:15:14 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://alisonarts.com.au/admin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/5 34.23.124.185 - - [21/Aug/2026:18:15:16 +1000] "GET /.env.example HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; FacebookBot/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [21/Aug/2026:18:15:16 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; FacebookBot/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [21/Aug/2026:18:15:15 +1000] "GET /workspace HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.23.124.185 - - [21/Aug/2026:18:15:14 +1000] "GET /my-account/ HTTP/1.1" 200 9260 "https://www.alisonarts.com.au/my" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Sa 34.23.124.185 - - [21/Aug/2026:18:15:16 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; FacebookBot/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [21/Aug/2026:18:15:16 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; FacebookBot/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [21/Aug/2026:18:15:15 +1000] "GET /.gitconfig HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; FacebookBot/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [21/Aug/2026:18:15:17 +1000] "GET /.env.backup HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; FacebookBot/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" == customkidscom/customkids.com.au-ssl_log == -- top paths -- 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /wpxml.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /she11.php 1 GET /sf.php 1 GET /samll.php 1 GET /radio.php 1 GET /ops.php 1 GET /one.php 1 GET /nox.php -- last 10 requests -- 20.251.48.93 - - [21/Aug/2026:18:14:43 +1000] "GET /btyuio.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:43 +1000] "GET /dehnl.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:44 +1000] "GET /234717/index.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:44 +1000] "GET /zoo2.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:45 +1000] "GET /zoo1.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:46 +1000] "GET /radio.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:46 +1000] "GET /hoket.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:47 +1000] "GET /one.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:48 +1000] "GET /bxroot.php HTTP/1.1" 401 36 "-" "-" 20.251.48.93 - - [21/Aug/2026:18:14:48 +1000] "GET /kuda.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-21 18:13:13 L1=0.86 run=1 blk=0 avail=6411 (54.7%) swpO=0 conn=2 myRSS=3010 php=0 phpRSS=0 ap=21 tcp=25 topuser=- 2026-08-21 18:13:13 L1=0.86 run=1 blk=0 avail=6412 (54.7%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=21 tcp=25 topuser=- 2026-08-21 18:13:23 L1=0.88 run=4 blk=0 avail=6198 (52.8%) swpO=0 conn=2 myRSS=3010 php=2 phpRSS=288 ap=19 tcp=24 topuser=madalice 2026-08-21 18:13:23 L1=0.88 run=3 blk=0 avail=6178 (52.7%) swpO=0 conn=1 myRSS=3010 php=2 phpRSS=306 ap=19 tcp=24 topuser=madalice 2026-08-21 18:13:33 L1=0.90 run=1 blk=0 avail=6430 (54.8%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=18 tcp=21 topuser=- 2026-08-21 18:13:33 L1=0.90 run=1 blk=0 avail=6429 (54.8%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=18 tcp=20 topuser=- 2026-08-21 18:13:43 L1=1.06 run=1 blk=0 avail=6440 (54.9%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=17 tcp=20 topuser=- 2026-08-21 18:13:43 L1=1.06 run=1 blk=0 avail=6441 (54.9%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=17 tcp=19 topuser=- 2026-08-21 18:13:53 L1=1.05 run=3 blk=0 avail=6392 (54.5%) swpO=0 conn=1 myRSS=3010 php=1 phpRSS=79 ap=17 tcp=18 topuser=evolution 2026-08-21 18:13:53 L1=1.05 run=2 blk=0 avail=6383 (54.4%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=91 ap=17 tcp=18 topuser=evolution 2026-08-21 18:14:03 L1=0.89 run=2 blk=0 avail=6296 (53.7%) swpO=0 conn=1 myRSS=3010 php=1 phpRSS=173 ap=17 tcp=18 topuser=evolution 2026-08-21 18:14:03 L1=0.89 run=3 blk=0 avail=6292 (53.6%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=176 ap=17 tcp=18 topuser=evolution 2026-08-21 18:14:13 L1=0.91 run=1 blk=0 avail=6436 (54.9%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=18 tcp=23 topuser=- 2026-08-21 18:14:13 L1=0.91 run=2 blk=0 avail=6436 (54.9%) swpO=0 conn=2 myRSS=3010 php=0 phpRSS=0 ap=18 tcp=23 topuser=- 2026-08-21 18:14:23 L1=1.00 run=1 blk=0 avail=6416 (54.7%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=19 tcp=25 topuser=- 2026-08-21 18:14:23 L1=1.00 run=3 blk=0 avail=6403 (54.6%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=40 ap=19 tcp=25 topuser=evolution 2026-08-21 18:14:33 L1=0.93 run=2 blk=0 avail=6306 (53.8%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=115 ap=22 tcp=23 topuser=evolution 2026-08-21 18:14:33 L1=0.93 run=3 blk=0 avail=6292 (53.6%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=127 ap=22 tcp=23 topuser=evolution 2026-08-21 18:14:43 L1=0.94 run=2 blk=0 avail=6340 (54.1%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=99 ap=19 tcp=25 topuser=evolution 2026-08-21 18:14:43 L1=0.94 run=3 blk=0 avail=6330 (54.0%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=107 ap=19 tcp=25 topuser=evolution 2026-08-21 18:14:53 L1=0.87 run=3 blk=0 avail=6305 (53.8%) swpO=0 conn=2 myRSS=3010 php=1 phpRSS=176 ap=20 tcp=29 topuser=evolution 2026-08-21 18:14:53 L1=0.87 run=1 blk=0 avail=6451 (55.0%) swpO=0 conn=1 myRSS=3010 php=0 phpRSS=0 ap=20 tcp=29 topuser=- 2026-08-21 18:15:03 L1=1.05 run=2 blk=0 avail=6119 (52.2%) swpO=0 conn=2 myRSS=3010 php=3 phpRSS=400 ap=22 tcp=29 topuser=corpkicks 2026-08-21 18:15:04 L1=1.05 run=2 blk=0 avail=6106 (52.1%) swpO=0 conn=1 myRSS=3010 php=3 phpRSS=409 ap=22 tcp=29 topuser=corpkicks 2026-08-21 18:15:14 L1=2.50 run=19 blk=0 avail=5434 (46.3%) swpO=0 conn=2 myRSS=3010 php=13 phpRSS=1252 ap=41 tcp=52 topuser=alison 2026-08-21 18:15:14 L1=2.50 run=17 blk=0 avail=5359 (45.7%) swpO=0 conn=1 myRSS=3010 php=13 phpRSS=1078 ap=43 tcp=52 topuser=alison 2026-08-21 18:15:24 L1=3.15 run=2 blk=0 avail=6024 (51.4%) swpO=0 conn=2 myRSS=3010 php=2 phpRSS=316 ap=43 tcp=39 topuser=madalice 2026-08-21 18:15:24 L1=3.15 run=2 blk=0 avail=6004 (51.2%) swpO=0 conn=1 myRSS=3010 php=2 phpRSS=332 ap=43 tcp=38 topuser=madalice 2026-08-21 18:15:34 L1=6.00 run=35 blk=0 avail=3023 (25.8%) swpO=5684 conn=26 myRSS=2925 php=25 phpRSS=4020 ap=102 tcp=63 topuser=madalice 2026-08-21 18:15:34 L1=6.00 run=40 blk=0 avail=3027 (25.8%) swpO=5683 conn=25 myRSS=2925 php=25 phpRSS=4017 ap=102 tcp=63 topuser=madalice