INCIDENT 2026-08-22 11:09:22 trigger: php_procs=29 php_rss=3292MB mysql_conn=30 ================================================================== load: 2.31 1.11 0.87 33/732 1663964 ncpu:10 mem_avail: 3962MB/11729MB (33.8%) swap_used:3475MB swapout:1175/s blocked(D):0 running:39 iowait:0.2% steal:0.0% php: 29 procs / 3292MB heaviest user: madalice (25 procs, 2935MB) apache: 100 procs tcp_estab: 89 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 25 3065 mysql 1 2485 nobody 99 1279 root 239 942 netdata 8 251 evolution 9 179 alison 1 97 mailman 20 93 corpkicks 2 83 cpanellogin 1 69 aaa 1 65 kurri 3 34 dovenull 6 26 wp-toolkit 6 17 zabbix 1 16 mailnull 3 12 named 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 25 3093 evolution 1 155 alison 1 97 aaa 1 73 corpkicks 1 71 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4932 MB Active(file): 2482 MB Inactive(file): 973 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 451 MB CommitLimit: 9960 MB Committed_AS: 12693 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 09:58:06 2856 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2534268 10.8 Ssl 7-03:18:47 /usr/sbin/mariadbd 1663797 1663789 madalice 210900 49.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663794 1663786 madalice 208912 49.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663868 1663506 madalice 206364 97.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663795 1663787 madalice 203524 47.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 199248 0.0 Ss 7-03:18:50 /usr/lib/systemd/systemd-journald 1220 1 netdata 198912 2.5 Ssl 54-00:59:29 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353013 1343371 root 188088 0.0 S 08:31:00 spamd child 1663869 1663572 madalice 173764 77.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663913 1659883 evolution 164504 40.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1663858 1663839 madalice 136560 38.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663871 1663571 madalice 135424 57.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663866 1663512 madalice 133968 56.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663859 1663838 madalice 129080 35.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663849 1663575 madalice 123672 33.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663847 1663509 madalice 117932 32.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663872 1663830 madalice 117380 47.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663862 1663840 madalice 116960 31.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663851 1663831 madalice 116916 31.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663860 1663837 madalice 116280 31.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663848 1663510 madalice 115508 30.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1343371 1 root 112544 0.0 Ss 08:45:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1663861 1663505 madalice 112468 29.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663855 1663833 madalice 111928 29.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663856 1663835 madalice 111736 29.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663857 1663836 madalice 107012 25.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663852 1663832 madalice 105764 25.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663854 1663834 madalice 105740 25.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663874 1663829 alison 103500 35.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353014 1343371 root 102836 0.0 S 08:31:00 spamd child 1663870 1663564 madalice 100388 33.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663924 1662905 madalice 99988 69.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663926 1663565 aaa 88048 58.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1663925 1663793 corpkicks 78668 27.0 D 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1663920 1663351 madalice 76264 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1651764 1353308 cpanellogin 71228 0.0 S 22:20 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 58316 0.0 Sl 54-00:59:28 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42300 0.0 Ss 31-08:27:59 cpsrvd (SSL) - waiting for connections 1469 1 root 39332 0.1 Ss 54-00:59:28 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33660 0.1 Sl 54-00:59:24 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1342210 1 root 26172 0.0 Ss 08:46:59 lfd - sleeping 1463 1 root 24816 0.0 Ss 54-00:59:28 tailwatchd 1659883 1276780 nobody 22056 0.1 S 07:38 /usr/sbin/httpd -k start 1662461 1276780 nobody 19916 0.0 S 02:00 /usr/sbin/httpd -k start 1663506 1276780 nobody 19236 0.0 S 00:22 /usr/sbin/httpd -k start 1662785 1276780 nobody 19024 0.0 S 01:22 /usr/sbin/httpd -k start 1663351 1276780 nobody 19004 0.0 S 00:42 /usr/sbin/httpd -k start 1662898 1276780 nobody 18928 0.0 S 01:21 /usr/sbin/httpd -k start 1662216 1276780 nobody 18776 0.0 S 02:31 /usr/sbin/httpd -k start 1662905 1276780 nobody 18572 0.0 S 01:21 /usr/sbin/httpd -k start 1662907 1276780 nobody 18492 0.0 S 01:21 /usr/sbin/httpd -k start 1663509 1276780 nobody 18396 0.0 S 00:22 /usr/sbin/httpd -k start 1663391 1276780 nobody 18240 0.0 S 00:40 /usr/sbin/httpd -k start 1663564 1276780 nobody 18076 0.0 S 00:21 /usr/sbin/httpd -k start 1663570 1276780 nobody 18068 0.0 S 00:21 /usr/sbin/httpd -k start 1662787 1276780 nobody 18064 0.0 S 01:22 /usr/sbin/httpd -k start 185104 2431 netdata 18028 2.1 Sl 9-14:35:47 /usr/libexec/netdata/plugins.d/apps.plugin 1 1663474 1276780 nobody 17996 0.0 S 00:24 /usr/sbin/httpd -k start 1663358 1276780 nobody 17984 0.0 S 00:41 /usr/sbin/httpd -k start 1663511 1276780 nobody 17908 0.0 S 00:22 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23080494 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 93 evolution/evolutionerp.com.au-ssl_log 90 corpkicks/corporatekicks.com.au-ssl_log 77 corpkicks/corporatekicks.com.au 75 aaa/aaadownunder.com.au-ssl_log 22 aaa/aaadownunder.com.au 13 evolution/portal.evolutionerp.com.au-ssl_log 5 tubesupplies/tubesupplies.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 150 40.85.222.29 88 158.158.34.183 67 34.139.77.106 25 82.102.18.220 21 20.226.7.189 9 49.176.62.180 8 149.50.107.21 5 203.54.180.238 3 118.127.40.55 2 91.92.243.243 2 114.119.146.16 1 40.77.167.14 1 40.74.68.220 1 34.196.51.17 1 34.176.152.252 --- top request paths across all vhosts (last 3 min) --- 10 GET / 6 POST /wp-login.php 5 GET /store/custom-hawthorn-hawks-kids/ 5 GET /heartbeat.php 4 GET /wp-admin/index.php 3 POST /wp-cron.php 3 GET /wp-login.php 3 GET /rclone.conf 2 POST / 2 GET /www/ 2 GET /wp-json 2 GET /wp-includes/widgets/system.php 2 GET /wp-includes/widgets/goat.php 2 GET /wp-includes/widgets/class-wp-widget-media-statement.php 2 GET /wp-includes/widgets/class-wp-widget-archives-add.php 2 GET /wp-includes/Text/zcrtg.php 2 GET /wp-includes/Text/lzmelu.php 2 GET /wp-includes/sitemaps/providers/file.php 2 GET /wp-includes/orvxmailer.php 2 GET /wp-includes/js/jcrop/Jcrop.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 10 GET / 5 GET /store/custom-hawthorn-hawks-kids/ 3 GET /rclone.conf 2 POST / 2 GET /wp-json 2 GET /product-category/custom-shoes/budget/ 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 1 GET /z9x8c7v6b5-debug-trigger-webmail.madalice.com.au 1 GET /wp-content/plugins/WordPressCore/ -- last 10 requests -- 34.139.77.106 - - [22/Aug/2026:11:09:26 +1000] "GET /actuator HTTP/1.1" 401 12597 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.77.106 - - [22/Aug/2026:11:09:26 +1000] "GET /actuator/configprops HTTP/1.1" 401 12600 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.77.106 - - [22/Aug/2026:11:09:26 +1000] "GET /.git/HEAD HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.77.106 - - [22/Aug/2026:11:09:20 +1000] "GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au HTTP/1.1" 301 1 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.77.106 - - [22/Aug/2026:11:09:26 +1000] "GET /.aws/config HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.77.106 - - [22/Aug/2026:11:09:20 +1000] "GET /login HTTP/1.1" 302 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.77.106 - - [22/Aug/2026:11:09:19 +1000] "GET /wp-json HTTP/1.1" 200 50900 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.77.106 - - [22/Aug/2026:11:09:20 +1000] "GET /user/login HTTP/1.1" 404 30618 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.139.77.106 - - [22/Aug/2026:11:09:20 +1000] "GET /.s3cfg HTTP/1.1" 404 184751 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.77.106 - - [22/Aug/2026:11:09:20 +1000] "GET /.aider.conf.yml HTTP/1.1" 404 184760 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php -- last 10 requests -- 158.158.34.183 - - [22/Aug/2026:11:09:02 +1000] "GET /xx.php HTTP/1.1" 404 20778 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:03 +1000] "GET /wp-content/about.php HTTP/1.1" 404 20782 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:05 +1000] "GET /wp-includes/assets/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:06 +1000] "GET /wp-the.php HTTP/1.1" 404 20780 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:07 +1000] "GET /ws81.php HTTP/1.1" 404 20779 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:09 +1000] "GET /3.php HTTP/1.1" 404 20776 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:10 +1000] "GET /a1.php HTTP/1.1" 404 20776 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:12 +1000] "GET /ca5.php HTTP/1.1" 404 20777 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:13 +1000] "GET /install.php HTTP/1.1" 404 20781 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [22/Aug/2026:11:09:15 +1000] "GET /radio.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 HEAD / 1 GET /wp-includes/widgets/system.php 1 GET /wp-includes/widgets/goat.php 1 GET /wp-includes/widgets/class-wp-widget-media-statement.php 1 GET /wp-includes/widgets/class-wp-widget-archives-add.php 1 GET /wp-includes/Text/zcrtg.php 1 GET /wp-includes/Text/lzmelu.php 1 GET /wp-includes/sitemaps/providers/file.php 1 GET /wp-includes/orvxmailer.php 1 GET /wp-includes/js/jcrop/Jcrop.php 1 GET /wp-includes/IXR/class-IXR-client-merge.php -- last 10 requests -- 40.85.222.29 - - [22/Aug/2026:11:08:23 +1000] "GET /.well-known/oasnykdf.php HTTP/1.1" 403 12 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:23 +1000] "GET /wp-admin/css/colors/ectoplasm/BjNYgNIU.php HTTP/1.1" 403 6789 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:24 +1000] "GET /wp-admin/css/colors/blue/admin.php HTTP/1.1" 403 6789 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:25 +1000] "GET /wp-includes/block-bindings.php HTTP/1.1" 200 - "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:26 +1000] "GET /wp-admin/includes/lint-branch.php HTTP/1.1" 403 6789 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:27 +1000] "GET /wp-includes/widgets/goat.php HTTP/1.1" 403 6789 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:28 +1000] "GET /wp-admin/js/hehe.php HTTP/1.1" 403 6789 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:29 +1000] "GET /wp-admin/css/colors/blue/ciyRFCk.php HTTP/1.1" 403 6789 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:30 +1000] "GET /wp-admin/css/colors/coffee/nosaSq.php HTTP/1.1" 403 6789 "-" "-" 40.85.222.29 - - [22/Aug/2026:11:08:32 +1000] "GET /wp-includes/class-wp-more.php HTTP/1.1" 403 6789 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 11:07:01 L1=0.39 run=1 blk=0 avail=6769 (57.7%) swpO=0 conn=1 myRSS=2528 php=0 phpRSS=0 ap=14 tcp=19 topuser=- 2026-08-22 11:07:08 L1=0.44 run=3 blk=0 avail=6729 (57.4%) swpO=0 conn=2 myRSS=2528 php=1 phpRSS=73 ap=14 tcp=20 topuser=corpkicks 2026-08-22 11:07:11 L1=0.56 run=3 blk=0 avail=6524 (55.6%) swpO=2 conn=1 myRSS=2528 php=2 phpRSS=312 ap=14 tcp=22 topuser=corpkicks 2026-08-22 11:07:18 L1=0.52 run=2 blk=0 avail=6640 (56.6%) swpO=2 conn=2 myRSS=2528 php=1 phpRSS=152 ap=14 tcp=23 topuser=corpkicks 2026-08-22 11:07:21 L1=0.47 run=5 blk=0 avail=6662 (56.8%) swpO=0 conn=1 myRSS=2528 php=2 phpRSS=154 ap=15 tcp=22 topuser=corpkicks 2026-08-22 11:07:28 L1=0.60 run=1 blk=0 avail=6740 (57.5%) swpO=0 conn=2 myRSS=2528 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-22 11:07:32 L1=0.55 run=4 blk=0 avail=6607 (56.3%) swpO=0 conn=1 myRSS=2528 php=1 phpRSS=97 ap=17 tcp=21 topuser=corpkicks 2026-08-22 11:07:38 L1=0.75 run=3 blk=0 avail=6679 (56.9%) swpO=0 conn=2 myRSS=2528 php=1 phpRSS=93 ap=17 tcp=21 topuser=evolution 2026-08-22 11:07:42 L1=0.77 run=2 blk=0 avail=6597 (56.2%) swpO=0 conn=2 myRSS=2528 php=1 phpRSS=173 ap=17 tcp=23 topuser=evolution 2026-08-22 11:07:48 L1=0.87 run=3 blk=0 avail=6673 (56.9%) swpO=0 conn=2 myRSS=2528 php=2 phpRSS=129 ap=17 tcp=25 topuser=evolution 2026-08-22 11:07:52 L1=0.96 run=4 blk=0 avail=6484 (55.3%) swpO=0 conn=2 myRSS=2528 php=2 phpRSS=323 ap=17 tcp=23 topuser=corpkicks 2026-08-22 11:07:58 L1=0.88 run=3 blk=0 avail=6529 (55.7%) swpO=0 conn=2 myRSS=2528 php=2 phpRSS=250 ap=20 tcp=38 topuser=madalice 2026-08-22 11:08:02 L1=0.97 run=3 blk=0 avail=6463 (55.1%) swpO=0 conn=2 myRSS=2528 php=2 phpRSS=133 ap=48 tcp=36 topuser=madalice 2026-08-22 11:08:08 L1=0.97 run=2 blk=0 avail=6429 (54.8%) swpO=0 conn=2 myRSS=2528 php=1 phpRSS=173 ap=42 tcp=25 topuser=evolution 2026-08-22 11:08:12 L1=1.05 run=1 blk=0 avail=6591 (56.2%) swpO=0 conn=2 myRSS=2528 php=0 phpRSS=0 ap=39 tcp=25 topuser=- 2026-08-22 11:08:18 L1=1.27 run=3 blk=0 avail=6526 (55.6%) swpO=0 conn=2 myRSS=2528 php=2 phpRSS=180 ap=32 tcp=25 topuser=evolution 2026-08-22 11:08:22 L1=1.27 run=3 blk=0 avail=6447 (55.0%) swpO=0 conn=2 myRSS=2528 php=2 phpRSS=282 ap=29 tcp=23 topuser=evolution 2026-08-22 11:08:28 L1=1.31 run=3 blk=0 avail=6587 (56.2%) swpO=2 conn=2 myRSS=2528 php=2 phpRSS=198 ap=22 tcp=24 topuser=corpkicks 2026-08-22 11:08:32 L1=1.31 run=6 blk=0 avail=6461 (55.1%) swpO=2 conn=2 myRSS=2528 php=4 phpRSS=385 ap=20 tcp=28 topuser=evolution 2026-08-22 11:08:39 L1=1.42 run=3 blk=0 avail=6609 (56.3%) swpO=0 conn=2 myRSS=2528 php=2 phpRSS=168 ap=21 tcp=31 topuser=evolution 2026-08-22 11:08:42 L1=1.42 run=6 blk=0 avail=6394 (54.5%) swpO=0 conn=3 myRSS=2528 php=2 phpRSS=357 ap=24 tcp=35 topuser=madalice 2026-08-22 11:08:49 L1=1.50 run=2 blk=0 avail=6635 (56.6%) swpO=0 conn=2 myRSS=2528 php=1 phpRSS=96 ap=24 tcp=26 topuser=madalice 2026-08-22 11:08:52 L1=1.50 run=3 blk=0 avail=6478 (55.2%) swpO=0 conn=3 myRSS=2528 php=2 phpRSS=306 ap=21 tcp=24 topuser=madalice 2026-08-22 11:08:59 L1=1.65 run=2 blk=0 avail=6575 (56.1%) swpO=0 conn=2 myRSS=2528 php=1 phpRSS=169 ap=22 tcp=42 topuser=madalice 2026-08-22 11:09:02 L1=1.65 run=3 blk=0 avail=6317 (53.9%) swpO=0 conn=3 myRSS=2528 php=1 phpRSS=183 ap=50 tcp=46 topuser=madalice 2026-08-22 11:09:09 L1=1.71 run=2 blk=0 avail=6519 (55.6%) swpO=0 conn=2 myRSS=2528 php=1 phpRSS=75 ap=44 tcp=25 topuser=madalice 2026-08-22 11:09:12 L1=1.71 run=2 blk=0 avail=6514 (55.5%) swpO=0 conn=3 myRSS=2528 php=1 phpRSS=97 ap=41 tcp=25 topuser=evolution 2026-08-22 11:09:19 L1=2.31 run=8 blk=0 avail=5867 (50.0%) swpO=0 conn=2 myRSS=2528 php=8 phpRSS=860 ap=52 tcp=89 topuser=madalice 2026-08-22 11:09:22 L1=2.31 run=39 blk=0 avail=3962 (33.8%) swpO=1175 conn=30 myRSS=2506 php=29 phpRSS=3292 ap=100 tcp=89 topuser=madalice 2026-08-22 11:09:29 L1=5.66 run=48 blk=0 avail=4015 (34.2%) swpO=7625 conn=34 myRSS=2349 php=37 phpRSS=3439 ap=93 tcp=63 topuser=madalice