INCIDENT 2026-08-25 09:29:43 trigger: php_rss=1905MB mysql_conn=19 ================================================================== load: 5.30 3.68 3.09 20/645 3598003 ncpu:10 mem_avail: 6214MB/11729MB (53.0%) swap_used:1089MB swapout:0/s blocked(D):0 running:27 iowait:0.0% steal:0.0% php: 23 procs / 1905MB heaviest user: olympic (16 procs, 1384MB) apache: 45 procs tcp_estab: 74 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1867 olympic 15 1342 nobody 44 778 root 233 752 evolution 10 332 netdata 8 277 madalice 1 205 cpanellogin 1 63 dovenull 6 47 mailnull 6 43 mailman 20 24 kurri 2 23 wp-toolkit 6 21 dovecot 3 18 zabbix 1 16 infinium 1 14 aaa 1 14 candyfabcom 1 13 named 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB olympic 15 1358 evolution 6 327 madalice 1 207 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6023 MB Active(file): 4791 MB Inactive(file): 679 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 398 MB CommitLimit: 9960 MB Committed_AS: 10672 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1913717 root 08:18:26 644 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 1912464 12.6 Ssl 05:58:26 /usr/sbin/mariadbd 3597944 3597788 madalice 227628 97.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 225636 2.5 Ssl 56-23:19:52 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2160755 2145741 root 176456 0.0 S 07:04:19 spamd child 2160756 2145741 root 151340 0.0 S 07:04:19 spamd child 3597955 3597303 olympic 135164 53.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597952 3597774 olympic 126236 48.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597960 3594387 olympic 121796 48.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597957 3595096 olympic 111200 43.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597958 3597787 olympic 109356 40.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597962 3597790 olympic 105860 45.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597963 3576290 olympic 94508 38.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597964 3595771 olympic 92408 29.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597971 3595078 olympic 91452 51.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597953 3597286 olympic 89828 27.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597966 3577478 olympic 89436 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2145741 1 root 88740 0.0 Ss 07:06:41 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3597956 3597592 olympic 79928 58.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597961 3593154 olympic 78056 23.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 71204 0.0 Rs 10-01:39:13 /usr/lib/systemd/systemd-journald 3597968 3597562 olympic 70236 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597951 3597619 evolution 69520 9.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3597972 3597969 olympic 69044 26.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597950 3595769 evolution 67644 8.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3339629 1353308 cpanellogin 64984 0.0 S 01:10:24 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3598012 3597789 olympic 55832 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3597940 3596547 evolution 44156 2.5 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3597970 3594389 evolution 43108 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42524 0.0 Ss 34-06:48:22 cpsrvd (SSL) - waiting for connections 2223 1201 root 42492 0.0 Sl 56-23:19:51 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 38160 0.1 Sl 56-23:19:47 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3598027 3595744 evolution 37240 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3577500 1276780 nobody 22208 0.3 S 06:28 /usr/sbin/httpd -k start 3575689 1276780 nobody 21916 0.0 S 08:14 /usr/sbin/httpd -k start 3576290 1276780 nobody 21484 0.0 S 07:33 /usr/sbin/httpd -k start 3593154 1276780 nobody 21460 0.0 S 04:24 /usr/sbin/httpd -k start 3595078 1276780 nobody 20984 0.0 S 02:53 /usr/sbin/httpd -k start 3578805 1276780 nobody 20888 0.0 S 05:23 /usr/sbin/httpd -k start 3597562 1276780 nobody 20868 0.1 S 00:30 /usr/sbin/httpd -k start 3577478 1276780 nobody 20728 0.0 S 06:29 /usr/sbin/httpd -k start 3594306 1276780 nobody 20688 0.0 S 03:33 /usr/sbin/httpd -k start 3578764 1276780 nobody 20468 0.0 S 05:25 /usr/sbin/httpd -k start 3595096 1276780 nobody 20052 0.1 S 02:52 /usr/sbin/httpd -k start 3594331 1276780 nobody 19884 0.0 S 03:32 /usr/sbin/httpd -k start 3596358 1276780 nobody 19636 0.0 S 01:34 /usr/sbin/httpd -k start 3597788 1276780 nobody 19632 0.3 S 00:17 /usr/sbin/httpd -k start 3594387 1276780 nobody 19624 0.0 S 03:31 /usr/sbin/httpd -k start 3595771 1276780 nobody 19616 0.0 S 02:14 /usr/sbin/httpd -k start 3596693 1276780 nobody 19512 0.0 S 01:18 /usr/sbin/httpd -k start 3594389 1276780 nobody 19264 0.0 S 03:31 /usr/sbin/httpd -k start 3595769 1276780 nobody 19240 0.0 S 02:14 /usr/sbin/httpd -k start 3597303 1276780 nobody 19144 0.0 S 00:45 /usr/sbin/httpd -k start 3595770 1276780 nobody 19096 0.0 S 02:14 /usr/sbin/httpd -k start 185104 2431 netdata 18928 2.1 Sl 12-12:56:10 /usr/libexec/netdata/plugins.d/apps.plugin 1 3597790 1276780 nobody 18860 0.0 S 00:17 /usr/sbin/httpd -k start 3596730 1276780 nobody 18756 0.0 S 01:15 /usr/sbin/httpd -k start 3595093 1276780 nobody 18724 0.0 S 02:52 /usr/sbin/httpd -k start 3595744 1276780 nobody 18544 0.0 S 02:16 /usr/sbin/httpd -k start 3596692 1276780 nobody 18372 0.0 S 01:18 /usr/sbin/httpd -k start 3594304 1276780 nobody 18356 0.0 S 03:33 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1111048 | lecsafec_evo | lecsafec_icatv2 | Execute | 1 | Sending data | update assets,results set results.asset_id=assets.id WHERE assets.uploadid='39059' AND results.uploadid=assets.uploadid AND assets.assetkey=results.assetkey AND assets.jobid=results.jobid | | 1111405 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 759 evolution/portal.evolutionerp.com.au-ssl_log 318 whiz/whizengineering.com.au 90 kamcool/kamcool.com.au-ssl_log 89 madalice/madalice.com.au-ssl_log 71 infinium/infinium.net.au-ssl_log 55 infinium/infinium.net.au 44 otterfencing/otterfencing.com.au 24 vinesit/westpanel.vinesit.com.au-ssl_log 16 customc/customcentral.com.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 521 203.54.180.238 255 103.104.165.99 130 150.228.163.253 112 20.104.50.220 96 20.104.86.241 90 20.104.104.62 46 101.119.125.193 41 103.104.164.114 38 182.239.240.254 37 4.223.171.219 23 185.192.70.10 20 110.174.119.207 16 20.240.128.207 13 165.225.233.87 7 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 281 POST /functions.php 139 GET /app/ajax.php 124 GET /factory_session_checker.php 82 GET /index.php 66 POST /plugins/csvexporter/plugin.php 63 GET /factory_session_processed_qty.php 63 GET /factory_session_joiner.php 61 GET /heartbeat.php 32 POST /quoteditsave.php 26 POST /app/ajax/selectFilterSingle.php 19 POST /app/ajax/selectFilter.php 16 POST /app/ajax.php 15 POST /plugins/fencecosting/plugin.php 14 POST /clienteditsave.php 10 GET //app/ajax.php 8 POST /jobeditsave.php 8 POST /inveditsave.php 7 POST /print.php 6 POST /logsave.php 6 POST /itemModify.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 281 POST /functions.php 139 GET /app/ajax.php 79 GET /index.php 66 POST /plugins/csvexporter/plugin.php 32 POST /quoteditsave.php 26 POST /app/ajax/selectFilterSingle.php 19 POST /app/ajax/selectFilter.php 16 POST /app/ajax.php 15 POST /plugins/fencecosting/plugin.php 14 POST /clienteditsave.php 10 GET //app/ajax.php 8 POST /jobeditsave.php -- last 10 requests -- 103.104.165.99 - - [25/Aug/2026:09:29:42 +1000] "GET /index.php?page=inventory HTTP/1.1" 200 36239 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 103.104.165.99 - - [25/Aug/2026:09:29:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.104.165.99 - - [25/Aug/2026:09:29:44 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [25/Aug/2026:09:29:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2239&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 101.119.125.193 - - [25/Aug/2026:09:29:44 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=GATE%20PRESSED%20CUS HTTP/1.1" 200 2248 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78717§io 103.104.165.99 - - [25/Aug/2026:09:29:45 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinventory&call=getUserSetting&caller=ajaxSubmitLocal&seq=12633335129 HTTP/1.1" 200 162 "https://my.evolutionerp.com.au/index.php 203.54.180.238 - - [25/Aug/2026:09:29:42 +1000] "GET /index.php?page=activities HTTP/1.1" 200 39516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 150.228.163.253 - - [25/Aug/2026:09:29:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2280" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [25/Aug/2026:09:29:43 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [25/Aug/2026:09:29:45 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 124 GET /factory_session_checker.php 63 GET /factory_session_processed_qty.php 63 GET /factory_session_joiner.php 61 GET /heartbeat.php 3 POST /portal/register 3 GET /index.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [25/Aug/2026:09:29:33 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [25/Aug/2026:09:29:33 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [25/Aug/2026:09:29:33 +1000] "GET /factory_session_joiner.php?id=34810 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [25/Aug/2026:09:29:34 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [25/Aug/2026:09:29:35 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [25/Aug/2026:09:29:35 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [25/Aug/2026:09:29:34 +1000] "GET /heartbeat.php?sentAt=1787614175&bytes=106,140,211,223&_=1787607241322 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9 203.54.180.238 - - [25/Aug/2026:09:29:36 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [25/Aug/2026:09:29:36 +1000] "GET /factory_session_joiner.php?id=34847 HTTP/1.1" 200 92 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [25/Aug/2026:09:29:36 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == whiz/whizengineering.com.au == -- top paths -- 1 GET /Zoo.php 1 GET /zoo2.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /x1da.php 1 GET /wpxml.php 1 GET /wp-includes/Text/Diff/Engine/file_ed27.php 1 GET /wp-includes/Text/Diff/Engine/file_cdd9.php 1 GET /wp-fure.php 1 GET /wp-css.php 1 GET /wp-content/uploads/file1.php 1 GET /wp-content/themes/index.php -- last 10 requests -- 20.104.104.62 - - [25/Aug/2026:09:28:48 +1000] "GET /wp5.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:48 +1000] "GET /12.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:48 +1000] "GET /dk.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:49 +1000] "GET /JawirGenk.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:49 +1000] "GET /wp6.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:49 +1000] "GET /index2.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:49 +1000] "GET /wkl.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:49 +1000] "GET /fw/faiyy.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:50 +1000] "GET /bdroot.php HTTP/1.1" 404 - "-" "-" 20.104.104.62 - - [25/Aug/2026:09:28:50 +1000] "GET /wpxml.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-25 09:27:22 L1=4.29 run=6 blk=0 avail=7065 (60.2%) swpO=0 conn=3 myRSS=1865 php=4 phpRSS=429 ap=49 tcp=47 topuser=madalice 2026-08-25 09:27:24 L1=4.29 run=5 blk=0 avail=7092 (60.5%) swpO=0 conn=3 myRSS=1865 php=6 phpRSS=461 ap=47 tcp=47 topuser=evolution 2026-08-25 09:27:32 L1=4.65 run=9 blk=0 avail=6772 (57.7%) swpO=0 conn=8 myRSS=1865 php=7 phpRSS=781 ap=53 tcp=59 topuser=madalice 2026-08-25 09:27:34 L1=4.65 run=2 blk=0 avail=7248 (61.8%) swpO=0 conn=3 myRSS=1865 php=2 phpRSS=127 ap=53 tcp=54 topuser=evolution 2026-08-25 09:27:42 L1=4.32 run=5 blk=0 avail=7158 (61.0%) swpO=0 conn=8 myRSS=1865 php=7 phpRSS=403 ap=47 tcp=55 topuser=madalice 2026-08-25 09:27:44 L1=4.32 run=8 blk=0 avail=7147 (60.9%) swpO=0 conn=3 myRSS=1865 php=4 phpRSS=196 ap=46 tcp=50 topuser=evolution 2026-08-25 09:27:52 L1=4.42 run=2 blk=0 avail=7286 (62.1%) swpO=0 conn=8 myRSS=1865 php=1 phpRSS=157 ap=43 tcp=47 topuser=otterfencing 2026-08-25 09:27:54 L1=4.42 run=4 blk=0 avail=7208 (61.5%) swpO=0 conn=3 myRSS=1865 php=4 phpRSS=332 ap=42 tcp=39 topuser=madalice 2026-08-25 09:28:02 L1=4.03 run=5 blk=0 avail=7371 (62.8%) swpO=0 conn=8 myRSS=1866 php=2 phpRSS=101 ap=42 tcp=45 topuser=madalice 2026-08-25 09:28:04 L1=4.03 run=5 blk=0 avail=7101 (60.5%) swpO=0 conn=3 myRSS=1866 php=5 phpRSS=462 ap=42 tcp=45 topuser=madalice 2026-08-25 09:28:13 L1=4.34 run=6 blk=0 avail=7133 (60.8%) swpO=0 conn=8 myRSS=1866 php=3 phpRSS=377 ap=45 tcp=48 topuser=madalice 2026-08-25 09:28:14 L1=4.34 run=6 blk=0 avail=7168 (61.1%) swpO=0 conn=3 myRSS=1866 php=5 phpRSS=389 ap=45 tcp=51 topuser=evolution 2026-08-25 09:28:23 L1=4.52 run=8 blk=0 avail=7024 (59.9%) swpO=0 conn=8 myRSS=1866 php=4 phpRSS=483 ap=48 tcp=54 topuser=madalice 2026-08-25 09:28:24 L1=4.52 run=4 blk=0 avail=7304 (62.3%) swpO=0 conn=2 myRSS=1866 php=1 phpRSS=95 ap=48 tcp=56 topuser=madalice 2026-08-25 09:28:33 L1=4.60 run=2 blk=0 avail=7089 (60.4%) swpO=0 conn=2 myRSS=1866 php=1 phpRSS=272 ap=55 tcp=53 topuser=corpkicks 2026-08-25 09:28:34 L1=4.60 run=5 blk=0 avail=7040 (60.0%) swpO=0 conn=2 myRSS=1866 php=4 phpRSS=427 ap=54 tcp=49 topuser=madalice 2026-08-25 09:28:43 L1=4.90 run=5 blk=0 avail=7115 (60.7%) swpO=0 conn=2 myRSS=1866 php=5 phpRSS=348 ap=49 tcp=50 topuser=evolution 2026-08-25 09:28:44 L1=4.90 run=4 blk=0 avail=7063 (60.2%) swpO=0 conn=2 myRSS=1866 php=3 phpRSS=351 ap=49 tcp=49 topuser=madalice 2026-08-25 09:28:53 L1=4.90 run=6 blk=0 avail=7198 (61.4%) swpO=0 conn=2 myRSS=1867 php=4 phpRSS=281 ap=49 tcp=57 topuser=infinium 2026-08-25 09:28:54 L1=4.90 run=5 blk=0 avail=7008 (59.7%) swpO=0 conn=2 myRSS=1867 php=4 phpRSS=479 ap=49 tcp=53 topuser=madalice 2026-08-25 09:29:03 L1=4.53 run=2 blk=0 avail=7330 (62.5%) swpO=0 conn=2 myRSS=1867 php=1 phpRSS=69 ap=50 tcp=51 topuser=madalice 2026-08-25 09:29:04 L1=4.53 run=4 blk=0 avail=7193 (61.3%) swpO=0 conn=2 myRSS=1867 php=2 phpRSS=237 ap=49 tcp=52 topuser=madalice 2026-08-25 09:29:13 L1=4.36 run=2 blk=0 avail=7333 (62.5%) swpO=0 conn=2 myRSS=1867 php=1 phpRSS=101 ap=44 tcp=48 topuser=madalice 2026-08-25 09:29:14 L1=4.36 run=3 blk=0 avail=7164 (61.1%) swpO=0 conn=2 myRSS=1867 php=2 phpRSS=295 ap=44 tcp=53 topuser=madalice 2026-08-25 09:29:23 L1=4.30 run=3 blk=0 avail=7113 (60.6%) swpO=0 conn=2 myRSS=1867 php=5 phpRSS=402 ap=48 tcp=48 topuser=madalice 2026-08-25 09:29:24 L1=4.30 run=3 blk=0 avail=7002 (59.7%) swpO=0 conn=5 myRSS=1867 php=4 phpRSS=458 ap=48 tcp=67 topuser=madalice 2026-08-25 09:29:33 L1=4.02 run=3 blk=0 avail=7307 (62.3%) swpO=0 conn=1 myRSS=1867 php=0 phpRSS=0 ap=54 tcp=44 topuser=- 2026-08-25 09:29:34 L1=4.02 run=3 blk=0 avail=7271 (62.0%) swpO=0 conn=5 myRSS=1867 php=1 phpRSS=106 ap=53 tcp=43 topuser=madalice 2026-08-25 09:29:43 L1=5.30 run=27 blk=0 avail=6214 (53.0%) swpO=0 conn=19 myRSS=1867 php=23 phpRSS=1905 ap=45 tcp=74 topuser=olympic 2026-08-25 09:29:45 L1=5.30 run=18 blk=0 avail=6342 (54.1%) swpO=0 conn=5 myRSS=1867 php=15 phpRSS=1327 ap=47 tcp=65 topuser=olympic