INCIDENT 2026-08-26 05:29:57 trigger: php_rss=1573MB ================================================================== load: 2.88 1.77 1.88 10/619 3565153 ncpu:10 mem_avail: 5459MB/11729MB (46.5%) swap_used:1031MB swapout:915/s blocked(D):0 running:10 iowait:0.2% steal:0.0% php: 10 procs / 1573MB heaviest user: madalice (8 procs, 1520MB) apache: 41 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2349 madalice 8 1605 root 236 975 nobody 40 675 mailman 20 378 netdata 8 255 cpanellogin 1 101 alison 1 58 evolution 5 47 dovenull 6 46 kurri 3 36 lowrange 2 29 infinium 2 28 wp-toolkit 6 20 dovecot 3 17 vinesit 1 14 cpanelphpmyadmin 1 14 zabbix 1 13 named 1 7 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1626 alison 1 53 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5224 MB Active(file): 3690 MB Inactive(file): 707 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 533 MB CommitLimit: 9960 MB Committed_AS: 8827 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2703186 root 04:18:41 12156 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2405828 13.7 Ssl 1-01:58:41 /usr/sbin/mariadbd 3565067 3565005 madalice 270628 74.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3565074 3564989 madalice 269724 74.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3565064 3550215 madalice 262076 70.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3565070 3563045 madalice 221680 65.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3565071 3564873 madalice 203176 59.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 199732 2.5 Ssl 57-19:20:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3565068 3562047 madalice 193756 58.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2956397 2938778 root 188636 0.0 S 02:59:59 spamd child 3565069 3565004 madalice 183016 54.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938778 1 root 176164 0.0 Ss 03:06:29 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2956399 2938778 root 168240 0.0 S 02:59:59 spamd child 3565105 3563048 madalice 160960 64.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938347 1353308 cpanellogin 104040 0.0 S 03:06:54 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 89144 0.0 Ss 10-21:39:28 /usr/lib/systemd/systemd-journald 3565133 3565046 alison 61008 17.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 44792 0.0 Sl 57-19:20:06 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3565114 3563029 evolution 40792 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 40316 0.1 Ss 57-19:20:06 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 39200 0.0 Ss 35-02:48:37 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 36032 0.1 Sl 57-19:20:02 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2938201 1 root 31360 0.0 Ss 03:07:03 lfd - sleeping 1463 1 root 25620 0.0 Ss 57-19:20:06 tailwatchd 3550215 1276780 nobody 24044 0.0 S 04:55 /usr/sbin/httpd -k start 3562770 1276780 nobody 23408 0.2 S 02:32 /usr/sbin/httpd -k start 3563029 1276780 nobody 22972 0.1 S 02:01 /usr/sbin/httpd -k start 3563376 1276780 nobody 22140 0.1 S 01:36 /usr/sbin/httpd -k start 3562771 1276780 nobody 22032 0.1 S 02:32 /usr/sbin/httpd -k start 3563045 1276780 nobody 21984 0.0 S 02:00 /usr/sbin/httpd -k start 3563048 1276780 nobody 21712 0.1 S 02:00 /usr/sbin/httpd -k start 3564369 1276780 nobody 21708 0.1 S 00:40 /usr/sbin/httpd -k start 3562047 1276780 nobody 21372 0.0 S 04:10 /usr/sbin/httpd -k start 3563405 1276780 nobody 20772 0.2 S 01:34 /usr/sbin/httpd -k start 3564785 1276780 nobody 20604 0.2 S 00:14 /usr/sbin/httpd -k start 2938061 2938042 mailman 20548 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 2938058 2938042 mailman 20528 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 2938060 2938042 mailman 20456 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 2938056 2938042 mailman 20420 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 2938055 2938042 mailman 20384 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 2938053 2938042 mailman 20376 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 2938052 2938042 mailman 20328 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 2938054 2938042 mailman 20320 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 2938057 2938042 mailman 20300 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 2938046 2938042 mailman 20144 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 2938045 2938042 mailman 20140 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 3563392 1276780 nobody 20120 0.0 S 01:35 /usr/sbin/httpd -k start 2938062 2938042 mailman 20064 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 2938048 2938042 mailman 20060 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 3562815 1276780 nobody 20056 0.1 S 02:27 /usr/sbin/httpd -k start 2938047 2938042 mailman 20036 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 2938044 2938042 mailman 20016 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 2938063 2938042 mailman 19980 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 2938050 2938042 mailman 19940 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 2938051 2938042 mailman 19896 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 2938049 2938042 mailman 19892 0.0 S 03:07:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 3563047 1276780 nobody 19892 0.0 S 02:00 /usr/sbin/httpd -k start 3563408 1276780 nobody 19656 0.0 S 01:34 /usr/sbin/httpd -k start 3564873 1276780 nobody 19636 0.2 S 00:13 /usr/sbin/httpd -k start 3564989 1276780 nobody 19508 0.2 S 00:08 /usr/sbin/httpd -k start 3564710 1276780 nobody 19384 0.1 S 00:17 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4673141 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 193 evolution/my.evolutionerp.com.au-ssl_log 138 tubesupplies/tubesupplies.com.au-ssl_log 138 whiz/whizengineering.com.au-ssl_log 89 candyfabcom/candyfab.com.au-ssl_log 87 vinesit/vinesit.com.au-ssl_log 79 bigdeals/bigdeals.com.au-ssl_log 39 evolution/portal.evolutionerp.com.au-ssl_log 27 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 164 143.244.57.90 138 20.104.50.220 118 52.139.37.240 106 103.104.165.99 89 20.220.10.235 87 20.104.104.62 27 203.54.180.238 26 101.182.108.127 14 64.31.55.44 2 52.167.144.238 2 52.167.144.225 2 40.77.167.77 2 129.153.196.0 2 114.119.140.234 2 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 42 GET /app/ajax.php 28 POST /functions.php 27 GET /heartbeat.php 15 GET /index.php 12 POST /clienteditsave.php 11 POST /plugins/csvexporter/plugin.php 8 POST /app/ajax.php 6 POST /plugins/fencecosting/plugin.php 6 POST /logsave.php 6 POST /app/ajax/selectFilterSingle.php 5 GET /store/xl-magnetic-drop-down-side-door-sneaker-display-case-black/ 4 GET /wp-content/min.php 4 GET /new.php 4 GET /7.php 3 POST /inveditsave.php 3 GET /ws37.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /av.php 3 GET /222.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/xl-magnetic-drop-down-side-door-sneaker-display-case-black/ 1 POST / 1 GET /www.sql 1 GET /wp-content/uploads/dump.sql 1 GET /wp-content/plugins/woocommerce/src/wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/src//wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/src/Admin/wp-content/plugins/woocommerce/src/ 1 GET /wp-content/plugins/woocommerce/src/Admin//wp-content/plugins/woocommerce/src/ 1 GET /wp-content/plugins/woocommerce/src/Admin/API/wp-content/plugins/woocommerce/src/Admin/ 1 GET /wp-content/plugins/woocommerce/src/Admin/API//wp-content/plugins/woocommerce/src/Admin/ 1 GET /wp-content/plugins/woocommerce/src/Admin/API/Reports/wp-content/plugins/woocommerce/src/Admin/API/ 1 GET /wp-content/plugins/woocommerce/src/Admin/API/Reports//wp-content/plugins/woocommerce/src/Admin/API/ -- last 10 requests -- 143.244.57.90 - - [26/Aug/2026:05:29:54 +1000] "GET /wp-content/plugins/woocommerce/src/Admin/API/Reports/Downloads/DataStore.php HTTP/1.1" 200 1 "-" "-" 64.31.55.44 - - [26/Aug/2026:05:29:52 +1000] "GET /users.sql HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.9" 64.31.55.44 - - [26/Aug/2026:05:29:52 +1000] "GET /db.sql HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 143.244.57.90 - - [26/Aug/2026:05:29:55 +1000] "GET /wp-content/plugins/woocommerce/src/Admin/API/Reports/Downloads/Files/ HTTP/1.1" 200 336 "-" "-" 64.31.55.44 - - [26/Aug/2026:05:29:53 +1000] "GET /db_backup.sql HTTP/1.1" 404 36648 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.16" 64.31.55.44 - - [26/Aug/2026:05:29:54 +1000] "GET /madalice.com.au_db.sql HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:05:29:54 +1000] "GET /database.sql HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:05:29:53 +1000] "GET /localhost.sql HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0" 64.31.55.44 - - [26/Aug/2026:05:29:54 +1000] "GET /mysql.sql HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:05:29:54 +1000] "GET /wp-content/uploads/dump.sql HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 42 GET /app/ajax.php 28 POST /functions.php 15 GET /index.php 12 POST /clienteditsave.php 11 POST /plugins/csvexporter/plugin.php 8 POST /app/ajax.php 6 POST /plugins/fencecosting/plugin.php 6 POST /logsave.php 6 POST /app/ajax/selectFilterSingle.php 3 POST /inveditsave.php 1 POST //functions.php -- last 10 requests -- 101.182.108.127 - - [26/Aug/2026:05:29:28 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 3958 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 40.77.167.77 - - [26/Aug/2026:05:29:29 +1000] "GET /index.php?page=activities&keyword=barbara+blei HTTP/1.1" 200 5266 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/ 101.182.108.127 - - [26/Aug/2026:05:29:37 +1000] "GET /index.php?page=invedit&id=886 HTTP/1.1" 200 35902 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 101.182.108.127 - - [26/Aug/2026:05:29:38 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=886&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 101.182.108.127 - - [26/Aug/2026:05:29:38 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D886%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=16808218021 HTTP/1.1" 200 108 "https://my. 101.182.108.127 - - [26/Aug/2026:05:29:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=886&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 103.104.165.99 - - [26/Aug/2026:05:29:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11735&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 52.167.144.225 - - [26/Aug/2026:05:29:40 +1000] "GET /index.php?page=activities&keyword=great+food+truck+festival HTTP/1.1" 200 5274 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http: 103.104.165.99 - - [26/Aug/2026:05:29:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11979&tab=jobeditpick" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [26/Aug/2026:05:29:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12027" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /naxc.php 2 GET /LegioN_LeakeRs.php 1 GET /yellow.php 1 GET /xxxx.php 1 GET /xxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x.php 1 GET /xeqdlun.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php -- last 10 requests -- 20.104.50.220 - - [26/Aug/2026:05:29:07 +1000] "GET /031.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:07 +1000] "GET /size.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:07 +1000] "GET /error.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:08 +1000] "GET /404.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:08 +1000] "GET /file32.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:09 +1000] "GET /lol.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:09 +1000] "GET /haa.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:10 +1000] "GET /333.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:10 +1000] "GET /ws38.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [26/Aug/2026:05:29:11 +1000] "GET /xx.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-26 05:27:35 L1=0.83 run=2 blk=0 avail=6855 (58.4%) swpO=0 conn=2 myRSS=2376 php=1 phpRSS=40 ap=18 tcp=26 topuser=evolution 2026-08-26 05:27:37 L1=0.85 run=2 blk=0 avail=6774 (57.8%) swpO=0 conn=1 myRSS=2376 php=1 phpRSS=123 ap=17 tcp=24 topuser=madalice 2026-08-26 05:27:45 L1=0.86 run=2 blk=0 avail=6861 (58.5%) swpO=0 conn=2 myRSS=2376 php=1 phpRSS=40 ap=17 tcp=26 topuser=evolution 2026-08-26 05:27:47 L1=0.79 run=1 blk=0 avail=6871 (58.6%) swpO=0 conn=1 myRSS=2376 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-26 05:27:55 L1=0.73 run=2 blk=0 avail=6754 (57.6%) swpO=0 conn=2 myRSS=2376 php=2 phpRSS=176 ap=16 tcp=27 topuser=madalice 2026-08-26 05:27:57 L1=0.75 run=1 blk=0 avail=6864 (58.5%) swpO=0 conn=1 myRSS=2376 php=0 phpRSS=0 ap=17 tcp=29 topuser=- 2026-08-26 05:28:05 L1=0.77 run=2 blk=0 avail=6734 (57.4%) swpO=0 conn=2 myRSS=2376 php=2 phpRSS=141 ap=23 tcp=31 topuser=madalice 2026-08-26 05:28:07 L1=0.87 run=3 blk=0 avail=6656 (56.7%) swpO=0 conn=1 myRSS=2376 php=1 phpRSS=191 ap=23 tcp=30 topuser=madalice 2026-08-26 05:28:15 L1=0.88 run=4 blk=0 avail=6771 (57.7%) swpO=0 conn=2 myRSS=2376 php=2 phpRSS=94 ap=23 tcp=28 topuser=madalice 2026-08-26 05:28:17 L1=0.89 run=3 blk=0 avail=6641 (56.6%) swpO=0 conn=1 myRSS=2376 php=1 phpRSS=216 ap=21 tcp=27 topuser=madalice 2026-08-26 05:28:25 L1=0.90 run=9 blk=0 avail=6535 (55.7%) swpO=0 conn=2 myRSS=2376 php=8 phpRSS=488 ap=27 tcp=36 topuser=evolution 2026-08-26 05:28:27 L1=1.07 run=3 blk=0 avail=6694 (57.1%) swpO=0 conn=2 myRSS=2377 php=7 phpRSS=295 ap=27 tcp=37 topuser=evolution 2026-08-26 05:28:35 L1=1.14 run=10 blk=0 avail=6536 (55.7%) swpO=1 conn=2 myRSS=2377 php=9 phpRSS=430 ap=27 tcp=36 topuser=evolution 2026-08-26 05:28:37 L1=1.37 run=2 blk=0 avail=6680 (57.0%) swpO=1 conn=2 myRSS=2377 php=1 phpRSS=122 ap=27 tcp=35 topuser=alison 2026-08-26 05:28:45 L1=1.26 run=2 blk=0 avail=6772 (57.7%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=39 ap=26 tcp=31 topuser=evolution 2026-08-26 05:28:47 L1=1.24 run=2 blk=0 avail=6606 (56.3%) swpO=0 conn=2 myRSS=2377 php=2 phpRSS=247 ap=24 tcp=30 topuser=infinium 2026-08-26 05:28:55 L1=1.30 run=2 blk=0 avail=6661 (56.8%) swpO=0 conn=2 myRSS=2377 php=2 phpRSS=218 ap=22 tcp=30 topuser=evolution 2026-08-26 05:28:57 L1=1.36 run=3 blk=0 avail=6701 (57.1%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=151 ap=22 tcp=27 topuser=madalice 2026-08-26 05:29:05 L1=1.33 run=5 blk=0 avail=6427 (54.8%) swpO=0 conn=2 myRSS=2377 php=5 phpRSS=576 ap=20 tcp=28 topuser=corpkicks 2026-08-26 05:29:07 L1=1.46 run=2 blk=0 avail=6811 (58.1%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=76 ap=20 tcp=24 topuser=vinesit 2026-08-26 05:29:15 L1=1.59 run=2 blk=0 avail=6823 (58.2%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=39 ap=19 tcp=30 topuser=evolution 2026-08-26 05:29:17 L1=1.54 run=3 blk=0 avail=6743 (57.5%) swpO=0 conn=2 myRSS=2377 php=2 phpRSS=179 ap=19 tcp=31 topuser=madalice 2026-08-26 05:29:25 L1=1.66 run=3 blk=0 avail=6577 (56.1%) swpO=0 conn=2 myRSS=2377 php=2 phpRSS=320 ap=22 tcp=34 topuser=madalice 2026-08-26 05:29:27 L1=1.76 run=2 blk=0 avail=6717 (57.3%) swpO=0 conn=2 myRSS=2377 php=2 phpRSS=181 ap=22 tcp=33 topuser=madalice 2026-08-26 05:29:35 L1=1.78 run=3 blk=0 avail=6636 (56.6%) swpO=0 conn=2 myRSS=2377 php=2 phpRSS=246 ap=22 tcp=31 topuser=madalice 2026-08-26 05:29:37 L1=1.88 run=3 blk=0 avail=6750 (57.6%) swpO=0 conn=2 myRSS=2377 php=2 phpRSS=140 ap=22 tcp=31 topuser=alison 2026-08-26 05:29:45 L1=1.89 run=2 blk=0 avail=6737 (57.4%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=79 ap=28 tcp=38 topuser=corpkicks 2026-08-26 05:29:47 L1=1.90 run=3 blk=0 avail=6731 (57.4%) swpO=1 conn=2 myRSS=2377 php=1 phpRSS=89 ap=28 tcp=36 topuser=vinesit 2026-08-26 05:29:56 L1=1.83 run=15 blk=0 avail=5696 (48.6%) swpO=832 conn=2 myRSS=2349 php=12 phpRSS=1463 ap=42 tcp=54 topuser=madalice 2026-08-26 05:29:57 L1=2.88 run=10 blk=0 avail=5459 (46.5%) swpO=915 conn=10 myRSS=2349 php=10 phpRSS=1573 ap=41 tcp=44 topuser=madalice