INCIDENT 2026-08-25 15:02:05 trigger: php_rss=1959MB ================================================================== load: 4.49 3.18 2.42 26/670 637514 ncpu:10 mem_avail: 5667MB/11729MB (48.3%) swap_used:1143MB swapout:55/s blocked(D):0 running:21 iowait:0.1% steal:0.0% php: 20 procs / 1959MB heaviest user: corpkicks (4 procs, 728MB) apache: 42 procs tcp_estab: 60 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2233 root 247 876 corpkicks 4 765 nobody 41 763 evolution 18 547 madalice 2 432 netdata 8 275 alison 3 176 tubesupplies 1 99 cpanellogin 1 65 kurri 4 51 dovenull 6 47 mailman 20 24 wp-toolkit 6 21 dovecot 3 18 mailnull 3 16 zabbix 1 14 infinium 1 11 named 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB corpkicks 4 775 evolution 10 443 madalice 2 434 alison 1 146 tubesupplies 1 99 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5416 MB Active(file): 3613 MB Inactive(file): 1609 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 533 MB CommitLimit: 9960 MB Committed_AS: 9972 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 622103 root 02:04 1380 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1913717 root 13:50:48 408 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2287028 22.8 Ssl 11:30:48 /usr/sbin/mariadbd 637368 636667 madalice 315296 88.5 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 637443 617910 corpkicks 234896 57.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 637444 636981 corpkicks 232928 55.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 221180 2.5 Ssl 57-04:52:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 637448 636457 corpkicks 185020 84.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 637445 636431 corpkicks 183532 42.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2160755 2145741 root 183460 0.0 S 12:36:41 spamd child 2575382 1 root 181120 0.0 Ss 10-07:11:35 /usr/lib/systemd/systemd-journald 83438 2145741 root 174616 0.1 S 02:28:05 spamd child 637439 636430 alison 151536 59.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 637442 636683 madalice 138116 56.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 637447 635934 tubesupplies 105268 91.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 637421 621157 evolution 73364 7.7 S 00:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 637435 636453 evolution 68472 7.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 637430 622189 evolution 68260 5.6 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 27761 1353308 cpanellogin 66532 0.0 S 02:42:52 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2145741 1 root 60560 0.0 Ss 12:39:03 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 637429 637341 evolution 42416 1.3 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 637454 617685 evolution 40844 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 40656 0.0 Sl 57-04:52:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40380 0.0 Ss 34-12:20:44 cpsrvd (SSL) - waiting for connections 637455 636458 evolution 40048 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 637456 622282 evolution 40040 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 637460 637458 evolution 39568 10.0 Sl 00:01 /usr/local/bin/wkhtmltopdf --enable-local-file-access --encoding utf-8 --title QUOTATION --header-html /home/evolution/my.evolutionerp. 637422 621930 evolution 39336 0.5 S 00:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 38280 0.1 Ss 57-04:52:13 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 35040 0.1 Sl 57-04:52:09 /usr/libexec/netdata/plugins.d/go.d.plugin 1 618984 1276780 nobody 22528 0.0 S 04:47 /usr/sbin/httpd -k start 618960 1276780 nobody 22328 0.0 S 04:48 /usr/sbin/httpd -k start 619018 1276780 nobody 22016 0.0 S 04:46 /usr/sbin/httpd -k start 621235 1276780 nobody 21832 0.0 S 02:50 /usr/sbin/httpd -k start 618981 1276780 nobody 21788 0.0 S 04:47 /usr/sbin/httpd -k start 621159 1276780 nobody 21768 0.0 S 02:52 /usr/sbin/httpd -k start 621930 1276780 nobody 21732 0.1 S 02:14 /usr/sbin/httpd -k start 622189 1276780 nobody 21568 0.0 S 02:04 /usr/sbin/httpd -k start 628028 1276780 nobody 21496 0.0 S 01:59 /usr/sbin/httpd -k start 622282 1276780 nobody 21492 0.1 S 02:03 /usr/sbin/httpd -k start 620125 1276780 nobody 21108 0.0 S 03:46 /usr/sbin/httpd -k start 620150 1276780 nobody 21104 0.1 S 03:45 /usr/sbin/httpd -k start 622283 1276780 nobody 21104 0.0 S 02:03 /usr/sbin/httpd -k start 621157 1276780 nobody 20664 0.1 S 02:52 /usr/sbin/httpd -k start 621931 1276780 nobody 20576 0.0 S 02:14 /usr/sbin/httpd -k start 619016 1276780 nobody 20332 0.0 S 04:46 /usr/sbin/httpd -k start 636430 1276780 nobody 20272 0.0 S 01:08 /usr/sbin/httpd -k start 620151 1276780 nobody 20116 0.0 S 03:45 /usr/sbin/httpd -k start 622285 1276780 nobody 20080 0.0 S 02:03 /usr/sbin/httpd -k start 636458 1276780 nobody 19992 0.0 S 01:06 /usr/sbin/httpd -k start 620630 1276780 nobody 19940 0.0 S 03:24 /usr/sbin/httpd -k start 636668 1276780 nobody 19772 0.1 S 00:54 /usr/sbin/httpd -k start 636459 1276780 nobody 19584 0.0 S 01:06 /usr/sbin/httpd -k start 636667 1276780 nobody 19360 0.0 S 00:54 /usr/sbin/httpd -k start 636686 1276780 nobody 19212 0.0 S 00:53 /usr/sbin/httpd -k start 636454 1276780 nobody 19192 0.0 S 01:06 /usr/sbin/httpd -k start 636453 1276780 nobody 18964 0.0 S 01:06 /usr/sbin/httpd -k start 636457 1276780 nobody 18964 0.0 S 01:06 /usr/sbin/httpd -k start 636971 1276780 nobody 18920 0.0 S 00:36 /usr/sbin/httpd -k start 617910 1276780 nobody 18628 0.0 S 05:49 /usr/sbin/httpd -k start 636683 1276780 nobody 18540 0.0 S 00:53 /usr/sbin/httpd -k start 185104 2431 netdata 18416 2.1 Sl 12-18:28:32 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3838430 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3838429 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT id,name,defaultTemplate FROM uploads WHERE category = ? AND subtype LIKE ? AND status = '1' | | 3838423 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT GROUP_CONCAT(DISTINCT srcid) as d FROM stockmovement WHERE src = ? AND type = ? AND jobitemid IN (SELECT id FROM jobInventory WHERE jobid = ?) ORDER BY srcid | +---------+------+----------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 701 evolution/portal.evolutionerp.com.au-ssl_log 65 madalice/madalice.com.au-ssl_log 55 alison/alisonarts.com.au-ssl_log 24 tubesupplies/tubesupplies.com.au-ssl_log 9 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 315 203.54.180.238 185 103.104.165.99 74 103.104.164.114 69 150.228.163.253 53 101.166.96.210 38 4.232.148.111 28 110.174.119.207 24 20.104.87.97 10 180.181.236.49 9 182.239.240.254 8 147.161.213.78 8 118.127.40.55 6 1.144.107.82 5 20.48.147.90 3 40.77.167.50 --- top request paths across all vhosts (last 3 min) --- 186 POST /functions.php 153 GET /app/ajax.php 67 GET /index.php 46 POST /plugins/csvexporter/plugin.php 35 POST /quoteditsave.php 33 POST /app/ajax/selectFilter.php 32 POST /clienteditsave.php 29 POST /app/ajax/selectFilterSingle.php 25 GET /heartbeat.php 24 POST /app/ajax.php 17 GET /factory_session_checker.php 14 POST /jobeditsave.php 14 POST /itemModify.php 12 POST /plugins/fencecosting/plugin.php 10 POST //functions.php 9 GET /factory_session_processed_qty.php 9 GET /factory_session_joiner.php 8 POST /logsave.php 8 POST /invoiceaddsave.php 7 POST /inveditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 186 POST /functions.php 153 GET /app/ajax.php 65 GET /index.php 46 POST /plugins/csvexporter/plugin.php 35 POST /quoteditsave.php 33 POST /app/ajax/selectFilter.php 32 POST /clienteditsave.php 29 POST /app/ajax/selectFilterSingle.php 24 POST /app/ajax.php 14 POST /jobeditsave.php 14 POST /itemModify.php 12 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 203.54.180.238 - - [25/Aug/2026:15:02:03 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobadd"eid=78745" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [25/Aug/2026:15:02:03 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobadd%26quoteid%3D78745&call=getUserSetting&caller=ajaxSubmitLocal&seq=18968454681 HTTP/1.1" 200 102 "https://my.evolutionerp.c 103.104.165.99 - - [25/Aug/2026:15:02:03 +1000] "GET /index.php?page=purchaseadd&purchaseid=11248 HTTP/1.1" 200 69653 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11248" "Mozilla/5.0 (Windows NT 103.104.165.99 - - [25/Aug/2026:15:02:04 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11248" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 103.104.165.99 - - [25/Aug/2026:15:02:04 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17724892098 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [25/Aug/2026:15:02:04 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=11831619243 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [25/Aug/2026:15:02:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=jobadd"eid=78745" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [25/Aug/2026:15:02:04 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&supplierid=6220&contactid=6220&tid=%25%25&returnobj=itemFi 103.104.165.99 - - [25/Aug/2026:15:02:04 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D11248&call=getUserSetting&caller=ajaxSubmitLocal&seq=12084557245 HTTP/1.1" 200 117 103.104.165.99 - - [25/Aug/2026:15:02:04 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D11248&call=getUserSetting&caller=ajaxSubmitLocal&seq=10472389384 HTTP/1.1" 200 165 "https://my.evolut == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 36 GET /heartbeat.php 17 GET /factory_session_checker.php 9 GET /factory_session_processed_qty.php 9 GET /factory_session_joiner.php 2 POST /portal/register 2 GET /index.php 1 GET /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [25/Aug/2026:15:01:28 +1000] "GET /heartbeat.php?sentAt=1787634086&bytes=106,141,33,166&_=1787611173475 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:34 +1000] "GET /heartbeat.php?sentAt=1787634095&bytes=106,141,33,175&_=1787631299662 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:37 +1000] "GET /heartbeat.php?sentAt=1787634097&bytes=106,141,33,177&_=1787576069434 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:38 +1000] "GET /heartbeat.php?sentAt=1787634096&bytes=106,141,33,176&_=1787611173476 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:44 +1000] "GET /heartbeat.php?sentAt=1787634105&bytes=106,141,33,185&_=1787631299663 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:47 +1000] "GET /heartbeat.php?sentAt=1787634107&bytes=106,141,33,187&_=1787576069435 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:48 +1000] "GET /heartbeat.php?sentAt=1787634106&bytes=106,141,33,186&_=1787611173477 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:54 +1000] "GET /heartbeat.php?sentAt=1787634115&bytes=106,141,33,195&_=1787631299664 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:57 +1000] "GET /heartbeat.php?sentAt=1787634117&bytes=106,141,33,197&_=1787576069436 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [25/Aug/2026:15:01:58 +1000] "GET /heartbeat.php?sentAt=1787634116&bytes=106,141,33,196&_=1787611173478 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /wp-admin/admin-ajax.php 4 GET /store/custom-af1-drippy-swoosh/ 3 POST /wp-admin/admin-ajax.php 2 POST /wp-login.php 1 POST / 1 GET /x.php 1 GET /xleet.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-good.php 1 GET /wp-content/themes/pridmag/il.php 1 GET /wp-content/admin.php -- last 10 requests -- 2a09:bac5:3a54:18be::277:44 - - [25/Aug/2026:15:01:17 +1000] "POST /wp-login.php HTTP/1.1" 503 6742 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 4.232.148.111 - - [25/Aug/2026:15:01:20 +1000] "GET /aaa.php HTTP/1.1" 404 30622 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 118.127.40.55 - - [25/Aug/2026:15:01:04 +1000] "GET /wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=4fb213e84656748acd14c3ac9792f33c&signature=b94af3ab8e812c7eef6d0ec54c3c4ab4525c52b3f 114.119.131.88 - - [25/Aug/2026:15:01:21 +1000] "GET /store/custom-af1-drippy-swoosh/?amp%3Brating=2&wcpr_rating=4&wcpr_image=1&wcpr_page=2 HTTP/1.1" 200 47492 "https://madalice.com.au/store/custom-af1-drippy-swoosh/?amp 20.46.228.84 - - [25/Aug/2026:15:01:25 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36" 4.232.148.111 - - [25/Aug/2026:15:01:23 +1000] "GET /abcd.php HTTP/1.1" 404 30620 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [25/Aug/2026:15:01:25 +1000] "GET /wp-good.php HTTP/1.1" 404 30630 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.46.228.84 - - [25/Aug/2026:15:01:28 +1000] "POST / HTTP/1.1" 200 36621 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36" 4.232.148.111 - - [25/Aug/2026:15:01:28 +1000] "GET /simple.php HTTP/1.1" 404 30624 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [25/Aug/2026:15:01:31 +1000] "GET /edit-tags.php HTTP/1.1" 404 30630 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-25 14:59:44 L1=2.86 run=3 blk=0 avail=6650 (56.7%) swpO=31 conn=4 myRSS=2230 php=2 phpRSS=432 ap=46 tcp=37 topuser=madalice 2026-08-25 14:59:44 L1=2.86 run=5 blk=0 avail=6653 (56.7%) swpO=31 conn=4 myRSS=2230 php=2 phpRSS=434 ap=46 tcp=37 topuser=madalice 2026-08-25 14:59:54 L1=2.89 run=4 blk=0 avail=6500 (55.4%) swpO=0 conn=4 myRSS=2230 php=3 phpRSS=636 ap=46 tcp=43 topuser=madalice 2026-08-25 14:59:54 L1=2.89 run=11 blk=0 avail=6493 (55.4%) swpO=0 conn=4 myRSS=2230 php=3 phpRSS=640 ap=46 tcp=44 topuser=madalice 2026-08-25 15:00:04 L1=3.31 run=7 blk=0 avail=6170 (52.6%) swpO=72 conn=4 myRSS=2230 php=4 phpRSS=900 ap=52 tcp=52 topuser=madalice 2026-08-25 15:00:04 L1=3.31 run=5 blk=0 avail=6182 (52.7%) swpO=72 conn=5 myRSS=2230 php=4 phpRSS=901 ap=52 tcp=52 topuser=madalice 2026-08-25 15:00:14 L1=3.87 run=4 blk=0 avail=6596 (56.2%) swpO=0 conn=4 myRSS=2230 php=3 phpRSS=440 ap=55 tcp=52 topuser=madalice 2026-08-25 15:00:14 L1=3.87 run=4 blk=0 avail=6591 (56.2%) swpO=0 conn=5 myRSS=2230 php=4 phpRSS=452 ap=55 tcp=52 topuser=madalice 2026-08-25 15:00:24 L1=4.21 run=6 blk=0 avail=6451 (55.0%) swpO=0 conn=4 myRSS=2230 php=4 phpRSS=596 ap=56 tcp=51 topuser=madalice 2026-08-25 15:00:24 L1=4.21 run=6 blk=0 avail=6443 (54.9%) swpO=0 conn=5 myRSS=2230 php=4 phpRSS=606 ap=56 tcp=51 topuser=madalice 2026-08-25 15:00:34 L1=4.42 run=5 blk=1 avail=6645 (56.7%) swpO=0 conn=4 myRSS=2230 php=2 phpRSS=420 ap=48 tcp=40 topuser=madalice 2026-08-25 15:00:34 L1=4.42 run=4 blk=0 avail=6644 (56.7%) swpO=0 conn=5 myRSS=2230 php=2 phpRSS=420 ap=48 tcp=40 topuser=madalice 2026-08-25 15:00:44 L1=4.43 run=2 blk=0 avail=6755 (57.6%) swpO=0 conn=4 myRSS=2230 php=1 phpRSS=307 ap=43 tcp=42 topuser=madalice 2026-08-25 15:00:44 L1=4.43 run=3 blk=0 avail=6755 (57.6%) swpO=0 conn=5 myRSS=2230 php=1 phpRSS=307 ap=43 tcp=41 topuser=madalice 2026-08-25 15:00:54 L1=4.06 run=7 blk=0 avail=6559 (55.9%) swpO=0 conn=4 myRSS=2231 php=5 phpRSS=652 ap=39 tcp=44 topuser=madalice 2026-08-25 15:00:54 L1=4.06 run=6 blk=0 avail=6565 (56.0%) swpO=0 conn=5 myRSS=2231 php=5 phpRSS=653 ap=39 tcp=44 topuser=madalice 2026-08-25 15:01:04 L1=3.89 run=5 blk=0 avail=6433 (54.9%) swpO=26 conn=4 myRSS=2232 php=4 phpRSS=580 ap=52 tcp=51 topuser=madalice 2026-08-25 15:01:04 L1=3.89 run=7 blk=0 avail=6431 (54.8%) swpO=26 conn=5 myRSS=2232 php=4 phpRSS=581 ap=52 tcp=52 topuser=madalice 2026-08-25 15:01:14 L1=4.16 run=7 blk=0 avail=6464 (55.1%) swpO=120 conn=5 myRSS=2233 php=4 phpRSS=599 ap=57 tcp=46 topuser=madalice 2026-08-25 15:01:14 L1=4.16 run=5 blk=0 avail=6469 (55.2%) swpO=120 conn=5 myRSS=2233 php=4 phpRSS=600 ap=57 tcp=46 topuser=madalice 2026-08-25 15:01:25 L1=4.21 run=8 blk=1 avail=6404 (54.6%) swpO=0 conn=5 myRSS=2233 php=5 phpRSS=684 ap=54 tcp=50 topuser=madalice 2026-08-25 15:01:25 L1=4.21 run=9 blk=0 avail=6413 (54.7%) swpO=0 conn=5 myRSS=2233 php=5 phpRSS=685 ap=54 tcp=50 topuser=madalice 2026-08-25 15:01:35 L1=3.95 run=6 blk=0 avail=6457 (55.1%) swpO=0 conn=5 myRSS=2233 php=7 phpRSS=689 ap=56 tcp=43 topuser=madalice 2026-08-25 15:01:35 L1=3.95 run=7 blk=0 avail=6450 (55.0%) swpO=0 conn=5 myRSS=2233 php=5 phpRSS=612 ap=56 tcp=43 topuser=madalice 2026-08-25 15:01:45 L1=4.76 run=5 blk=0 avail=6575 (56.1%) swpO=0 conn=5 myRSS=2233 php=5 phpRSS=543 ap=50 tcp=53 topuser=madalice 2026-08-25 15:01:45 L1=4.76 run=5 blk=0 avail=6566 (56.0%) swpO=0 conn=5 myRSS=2233 php=5 phpRSS=552 ap=50 tcp=54 topuser=madalice 2026-08-25 15:01:55 L1=4.49 run=6 blk=0 avail=6376 (54.4%) swpO=0 conn=5 myRSS=2233 php=6 phpRSS=833 ap=43 tcp=44 topuser=madalice 2026-08-25 15:01:55 L1=4.49 run=7 blk=0 avail=6365 (54.3%) swpO=0 conn=5 myRSS=2233 php=6 phpRSS=843 ap=43 tcp=44 topuser=madalice 2026-08-25 15:02:05 L1=4.49 run=21 blk=0 avail=5667 (48.3%) swpO=55 conn=14 myRSS=2233 php=20 phpRSS=1959 ap=42 tcp=60 topuser=corpkicks 2026-08-25 15:02:05 L1=4.49 run=18 blk=0 avail=5641 (48.1%) swpO=129 conn=14 myRSS=2233 php=19 phpRSS=1957 ap=42 tcp=60 topuser=corpkicks