INCIDENT 2026-08-26 18:38:40 trigger: php_rss=2292MB mysql_conn=15 ================================================================== load: 2.33 1.95 1.42 10/621 2227739 ncpu:10 mem_avail: 4987MB/11729MB (42.5%) swap_used:1480MB swapout:0/s blocked(D):0 running:21 iowait:1.7% steal:0.0% php: 13 procs / 2292MB heaviest user: madalice (13 procs, 2292MB) apache: 38 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2410 madalice 13 2401 root 241 807 nobody 36 608 netdata 8 255 mailman 20 202 cpanellogin 1 62 dovenull 6 46 mailnull 4 31 aaa 2 29 candyfabcom 2 28 wp-toolkit 6 19 dovecot 3 19 evolution 6 16 zabbix 1 11 kurri 1 7 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 mysql 1 2410 madalice 13 2401 root 241 807 nobody 36 608 netdata 8 255 mailman 20 202 cpanellogin 1 62 dovenull 6 46 mailnull 4 31 aaa 2 29 candyfabcom 2 28 wp-toolkit 6 19 dovecot 3 19 evolution 6 16 zabbix 1 11 kurri 1 7 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB --- php workers by user --- USER PROCS RSS_MB madalice 13 2405 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 madalice 13 2406 --- vm tuning / memory pressure --- vm.swappiness 30 vm.overcommit_ratio 50 Cached: 5382 MB Active(file): 3555 MB Inactive(file): 661 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 428 MB CommitLimit: 9960 MB Committed_AS: 9403 MB --- backup / dump / scan processes (page-cache evictors) --- vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5264 MB Active(file): 3555 MB Inactive(file): 660 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 428 MB CommitLimit: 9960 MB Committed_AS: 9234 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND PID USER ELAPSED RSS_KB COMMAND 2703186 root 17:27:23 4808 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- 2703186 root 17:27:23 4808 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2468344 16.3 Ssl 1-15:07:23 /usr/sbin/mariadbd 2227668 2227585 madalice 268680 116 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227662 2226372 madalice 243952 107 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227669 2227593 madalice 233376 102 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227664 2227591 madalice 232556 111 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227661 2227586 madalice 227496 100 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 201564 2.5 Ssl 58-08:28:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1065018 2938778 root 191936 0.1 S 05:26:35 spamd child 2227667 2227589 madalice 190412 84.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2956399 2938778 root 145444 0.0 S 16:08:41 spamd child 2227670 2227555 madalice 139736 114 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227671 2227545 madalice 106544 74.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938778 1 root 94792 0.0 Ss 16:15:11 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2227677 2227569 madalice 73420 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227676 2227556 madalice 69060 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2175075 1353308 cpanellogin 63680 0.0 S 17:17 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2575382 1 root 63176 0.0 Ss 11-10:48:10 /usr/lib/systemd/systemd-journald 1353308 1 root 42008 0.0 Ss 35-15:57:19 cpsrvd (SSL) - waiting for connections 2223 1201 root 41708 0.0 Sl 58-08:28:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33244 0.1 Sl 58-08:28:44 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2227666 2227546 madalice 29136 115 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227665 2210192 madalice 28996 115 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 25728 0.1 Ss 58-08:28:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2220104 1276780 nobody 22244 0.0 S 03:32 /usr/sbin/httpd -k start 2210192 1276780 nobody 22188 0.1 S 05:19 /usr/sbin/httpd -k start 2176748 1276780 nobody 22052 0.0 S 14:56 /usr/sbin/httpd -k start 2209325 1276780 nobody 21960 0.1 S 06:54 /usr/sbin/httpd -k start 1463 1 root 21684 0.0 Ss 58-08:28:48 tailwatchd 2211387 1276780 nobody 21508 0.0 S 03:51 /usr/sbin/httpd -k start 2226777 1276780 nobody 21144 0.1 S 01:35 /usr/sbin/httpd -k start 2226372 1276780 nobody 20724 0.1 S 02:10 /usr/sbin/httpd -k start 2226373 1276780 nobody 20464 0.1 S 02:10 /usr/sbin/httpd -k start 2938201 1 root 20224 0.0 Ss 16:15:45 lfd - sleeping 2227230 1276780 nobody 19992 0.1 S 00:49 /usr/sbin/httpd -k start 2227281 1276780 nobody 19976 0.1 S 00:43 /usr/sbin/httpd -k start 185104 2431 netdata 19940 2.1 Sl 13-22:05:07 /usr/libexec/netdata/plugins.d/apps.plugin 1 2227546 1276780 nobody 19740 0.1 S 00:16 /usr/sbin/httpd -k start 2227556 1276780 nobody 18644 0.1 S 00:15 /usr/sbin/httpd -k start 2227555 1276780 nobody 18620 0.1 S 00:15 /usr/sbin/httpd -k start 2227545 1276780 nobody 18580 0.0 S 00:16 /usr/sbin/httpd -k start 2227541 1276780 nobody 18512 0.0 S 00:17 /usr/sbin/httpd -k start 2227564 1276780 nobody 18496 0.0 S 00:14 /usr/sbin/httpd -k start 2227582 1276780 nobody 18440 0.0 S 00:13 /usr/sbin/httpd -k start 2227554 1276780 nobody 18432 0.1 S 00:15 /usr/sbin/httpd -k start 2227565 1276780 nobody 18432 0.0 S 00:14 /usr/sbin/httpd -k start 2227588 1276780 nobody 18432 0.0 S 00:13 /usr/sbin/httpd -k start 2227584 1276780 nobody 18376 0.0 S 00:13 /usr/sbin/httpd -k start 2227566 1276780 nobody 18368 0.0 S 00:14 /usr/sbin/httpd -k start 2227563 1276780 nobody 18364 0.1 S 00:14 /usr/sbin/httpd -k start 2227570 1276780 nobody 18340 0.0 S 00:14 /usr/sbin/httpd -k start 2227569 1276780 nobody 17416 0.0 S 00:14 /usr/sbin/httpd -k start 2227593 1276780 nobody 16928 0.0 S 00:13 /usr/sbin/httpd -k start 2227568 1276780 nobody 16708 0.0 S 00:14 /usr/sbin/httpd -k start 2227585 1276780 nobody 16472 0.0 S 00:13 /usr/sbin/httpd -k start 2227673 3828812 aaa 16172 5.0 S 00:01 dovecot/imap 2227580 1276780 nobody 16068 0.0 S 00:13 /usr/sbin/httpd -k start 2227595 1276780 nobody 16052 0.0 S 00:13 /usr/sbin/httpd -k start 2227589 1276780 nobody 15908 0.0 S 00:13 /usr/sbin/httpd -k start 2227591 1276780 nobody 15904 0.0 S 00:13 /usr/sbin/httpd -k start 2227586 1276780 nobody 15848 0.0 S 00:13 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2468344 16.3 Ssl 1-15:07:23 /usr/sbin/mariadbd 2227668 2227585 madalice 269804 116 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227662 2226372 madalice 244744 108 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227664 2227591 madalice 234140 112 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227669 2227593 madalice 233904 102 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227661 2227586 madalice 227496 100 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 201564 2.5 Ssl 58-08:28:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2227667 2227589 madalice 192072 85.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1065018 2938778 root 191936 0.1 S 05:26:35 spamd child 2956399 2938778 root 145444 0.0 S 16:08:41 spamd child 2227670 2227555 madalice 140936 115 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227671 2227545 madalice 106544 74.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938778 1 root 94792 0.0 Ss 16:15:11 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2227677 2227569 madalice 74740 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2227676 2227556 madalice 69852 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2175075 1353308 cpanellogin 63680 0.0 S 17:17 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2575382 1 root 63176 0.0 Ss 11-10:48:10 /usr/lib/systemd/systemd-journald 1353308 1 root 42008 0.0 Ss 35-15:57:19 cpsrvd (SSL) - waiting for connections 2223 1201 root 41708 0.0 Sl 58-08:28:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33244 0.1 Sl 58-08:28:44 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 25728 0.1 Ss 58-08:28:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2220104 1276780 nobody 22244 0.0 S 03:32 /usr/sbin/httpd -k start 2210192 1276780 nobody 22188 0.1 R 05:19 /usr/sbin/httpd -k start 2176748 1276780 nobody 22052 0.0 S 14:56 /usr/sbin/httpd -k start 2209325 1276780 nobody 21960 0.1 S 06:54 /usr/sbin/httpd -k start 1463 1 root 21684 0.0 Ss 58-08:28:48 tailwatchd 2211387 1276780 nobody 21508 0.0 S 03:51 /usr/sbin/httpd -k start 2226777 1276780 nobody 21144 0.1 S 01:35 /usr/sbin/httpd -k start 2226372 1276780 nobody 20724 0.1 S 02:10 /usr/sbin/httpd -k start 2226373 1276780 nobody 20464 0.1 S 02:10 /usr/sbin/httpd -k start 2938201 1 root 20224 0.0 Ss 16:15:45 lfd - sleeping 2227230 1276780 nobody 19992 0.1 S 00:49 /usr/sbin/httpd -k start 2227281 1276780 nobody 19976 0.1 S 00:43 /usr/sbin/httpd -k start 185104 2431 netdata 19940 2.1 Sl 13-22:05:07 /usr/libexec/netdata/plugins.d/apps.plugin 1 2227546 1276780 nobody 19748 0.1 S 00:16 /usr/sbin/httpd -k start 2227556 1276780 nobody 18644 0.1 S 00:15 /usr/sbin/httpd -k start 2227555 1276780 nobody 18620 0.1 S 00:15 /usr/sbin/httpd -k start 2227545 1276780 nobody 18580 0.0 S 00:16 /usr/sbin/httpd -k start 2227541 1276780 nobody 18512 0.0 S 00:17 /usr/sbin/httpd -k start 2227564 1276780 nobody 18496 0.0 S 00:14 /usr/sbin/httpd -k start 2227582 1276780 nobody 18440 0.0 S 00:13 /usr/sbin/httpd -k start 2227554 1276780 nobody 18432 0.1 S 00:15 /usr/sbin/httpd -k start 2227565 1276780 nobody 18432 0.0 S 00:14 /usr/sbin/httpd -k start 2227588 1276780 nobody 18432 0.0 S 00:13 /usr/sbin/httpd -k start 2227584 1276780 nobody 18376 0.0 S 00:13 /usr/sbin/httpd -k start 2227566 1276780 nobody 18368 0.0 S 00:14 /usr/sbin/httpd -k start 2227563 1276780 nobody 18364 0.1 S 00:14 /usr/sbin/httpd -k start 2227570 1276780 nobody 18340 0.0 S 00:14 /usr/sbin/httpd -k start 2227569 1276780 nobody 17416 0.0 S 00:14 /usr/sbin/httpd -k start 2227593 1276780 nobody 16928 0.0 S 00:13 /usr/sbin/httpd -k start 2227568 1276780 nobody 16708 0.0 S 00:14 /usr/sbin/httpd -k start 2227585 1276780 nobody 16472 0.0 S 00:13 /usr/sbin/httpd -k start 2227673 3828812 aaa 16172 5.0 S 00:01 dovecot/imap 2227580 1276780 nobody 16068 0.0 S 00:13 /usr/sbin/httpd -k start 2227595 1276780 nobody 16052 0.0 S 00:13 /usr/sbin/httpd -k start 2227589 1276780 nobody 15908 0.0 S 00:13 /usr/sbin/httpd -k start 2227591 1276780 nobody 15904 0.0 S 00:13 /usr/sbin/httpd -k start 2227586 1276780 nobody 15848 0.0 S 00:13 /usr/sbin/httpd -k start 2227469 3828812 candyfabcom 14756 0.0 S 00:23 dovecot/imap 2227465 3828812 candyfabcom 14520 0.0 S 00:24 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8812948 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- mariadb processlist (non-sleeping) --- --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8812949 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 8812939 | madalice_wp | madalice_wp | Query | 0 | Statistics | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'woocommerce_wc_square_sync_completed_settings' LIMIT 1 | | 8812934 | madalice_wp | madalice_wp | Query | 0 | starting | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'woocommerce_wc_square_gift_card_sent_settings' LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 183 madalice/madalice.com.au-ssl_log 97 VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 183 madalice/madalice.com.au-ssl_log 97 aaa/aaadownunder.com.au-ssl_log 69 evolution/my.evolutionerp.com.au-ssl_log 40 vinesit/vinesit.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 24 corpkicks/corporatekicks.com.au-ssl_log 4 aaa/aaadownunder.com.au-ssl_log 69 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- evolution/my.evolutionerp.com.au-ssl_log 40 vinesit/vinesit.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 24 corpkicks/corporatekicks.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 180 158.23.162.109 66 20.151.129.194 64 20.104.104.62 35 52.139.37.240 32 101.119.90.203 25 64.31.55.44 24 203.54.180.238 6 180.181.236.49 4 118.127.40.55 2 114.119.131.88 2 114.119.130.40 1 95.111.251.70 1 52.167.144.217 1 43.173.173.8 1 35.182.179.213 --- top request paths across all vhosts (last 3 min) --- 180 158.23.162.109 66 20.151.129.194 64 20.104.104.62 35 52.139.37.240 32 101.119.90.203 25 64.31.55.44 24 203.54.180.238 6 180.181.236.49 4 118.127.40.55 2 114.119.131.88 2 114.119.130.40 1 95.111.251.70 1 52.167.144.217 1 43.173.173.8 1 35.182.179.213 --- top request paths across all vhosts (last 3 min) --- 54 POST /wp-login.php 50 POST /xmlrpc.php 50 GET /wp-login.php 28 GET /xmlrpc.php 24 GET /heartbeat.php 13 POST /functions.php 9 GET /index.php 5 GET /app/ajax.php 4 POST /purchaseaddsave.php 4 GET /logoff.php 3 POST /wp-cron.php 3 GET /store/design-your-own-kicks-copy/ 3 GET /admin.php 3 GET /about.php 2 POST /plugins/csvexporter/plugin.php 2 GET /wp-signup.php 2 GET /wp-load.php 2 GET /wp-json/wp/v2/users 2 GET /wp-includes/ID3/about.php 2 GET /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 54 POST /wp-login.php 50 POST /xmlrpc.php 50 GET /wp-login.php 28 GET /xmlrpc.php 24 GET /heartbeat.php 13 POST /functions.php 9 GET /index.php 5 GET /app/ajax.php 4 POST /purchaseaddsave.php 4 GET /logoff.php 3 POST /wp-cron.php 3 GET /store/design-your-own-kicks-copy/ 3 GET /admin.php 3 GET /about.php 2 POST /plugins/csvexporter/plugin.php 2 GET /wp-signup.php 2 GET /wp-load.php 2 GET /wp-json/wp/v2/users 2 GET /wp-includes/ID3/about.php 2 GET /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 54 POST /wp-login.php 50 POST /xmlrpc.php 49 GET /wp-login.php 28 GET /xmlrpc.php 1 POST /wp-cron.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 158.23.162.109 - - [26/Aug/2026:18:37:59 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:37:59 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Linux; Android 11; Nokia G50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.61 158.23.162.109 - - [26/Aug/2026:18:38:01 +1000] "GET /xmlrpc.php HTTP/1.1" 404 123836 "https://www.evolutionerp.com.au" "Mozilla/5.0 (Linux; Android 11; Nokia G50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312 158.23.162.109 - - [26/Aug/2026:18:38:02 +1000] "GET /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:03 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:04 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0" 158.23.162.109 - - [26/Aug/2026:18:38:05 +1000] "GET /xmlrpc.php HTTP/1.1" 404 123838 "https://www.evolutionerp.com.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0" 158.23.162.109 - - [26/Aug/2026:18:38:06 +1000] "GET /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:08 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:09 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430 == madalice/madalice.com.au-ssl_log == -- top paths -- 54 POST /wp-login.php 50 POST /xmlrpc.php 49 GET /wp-login.php 28 GET /xmlrpc.php 1 POST /wp-cron.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 158.23.162.109 - - [26/Aug/2026:18:37:59 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:37:59 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Linux; Android 11; Nokia G50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.61 158.23.162.109 - - [26/Aug/2026:18:38:01 +1000] "GET /xmlrpc.php HTTP/1.1" 404 123836 "https://www.evolutionerp.com.au" "Mozilla/5.0 (Linux; Android 11; Nokia G50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312 158.23.162.109 - - [26/Aug/2026:18:38:02 +1000] "GET /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:03 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:04 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0" 158.23.162.109 - - [26/Aug/2026:18:38:05 +1000] "GET /xmlrpc.php HTTP/1.1" 404 123838 "https://www.evolutionerp.com.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0" 158.23.162.109 - - [26/Aug/2026:18:38:06 +1000] "GET /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:08 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:09 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430 == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/design-your-own-kicks-copy/ 2 GET /madalice.com.au.tar 1 POST / 1 GET /www.tar 1 GET /wwwroot.tar 1 GET /wp-signup.php 1 GET /wp-links-opml.php 1 GET /wp-includes/wp-load.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/style-engine/about.php 1 GET /wp-includes/SimplePie/about.php -- last 10 requests -- 3 GET /store/design-your-own-kicks-copy/ 2 GET /madalice.com.au.tar 1 POST / 1 GET /www.tar 1 GET /wwwroot.tar 1 GET /wp-signup.php 1 GET /wp-links-opml.php 1 GET /wp-includes/wp-load.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/style-engine/about.php 1 GET /wp-includes/SimplePie/about.php -- last 10 requests -- 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /test.tar HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15" 64.31.55.44 - - [26/Aug/2026:18:38:25 +1000] "GET /uploads.tar HTTP/1.1" 404 36639 "-" "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /public.tar HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6. 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /madalice.tar HTTP/1.1" 404 36639 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /htdocs.tar HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /public_html.tar HTTP/1.1" 404 36647 "-" "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Safari/605.1.15" 64.31.55.44 - - [26/Aug/2026:18:38:27 +1000] "GET /madalice.com.au.tar HTTP/1.1" 404 36641 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" 20.104.104.62 - - [26/Aug/2026:18:38:30 +1000] "GET /cgi-bin/cloud.php HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.104.62 - - [26/Aug/2026:18:38:32 +1000] "GET /wp-content/updates.php HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.104.62 - - [26/Aug/2026:18:38:35 +1000] "GET /css/cloud.php HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 GET /wp-json/wp/v2/users 2 GET /admin.php 2 GET /about.php 2 GET /aaa.php 1 GET /yj09.php 1 GET /wp-ws68.php 1 GET /wp-theme.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-json/wp/v2/media 1 GET /wp-includes/Text/ 1 GET /wp-includes/Requests/ -- last 10 requests -- 20.151.129.194 - - [26/Aug/2026:18:37:10 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:11 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:11 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:11 +1000] "GET /.well-known/about.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:12 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:12 +1000] "GET /wp-includes/Text/ HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:13 +1000] "GET /ts.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:13 +1000] "GET /bak.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:14 +1000] "GET /olik.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:14 +1000] "GET /about.php HTTP/1.1" 404 5749 "-" "-" 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /test.tar HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15" 64.31.55.44 - - [26/Aug/2026:18:38:25 +1000] "GET /uploads.tar HTTP/1.1" 404 36639 "-" "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /public.tar HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6. 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /madalice.tar HTTP/1.1" 404 36639 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /htdocs.tar HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:18:38:26 +1000] "GET /public_html.tar HTTP/1.1" 404 36647 "-" "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Safari/605.1.15" 64.31.55.44 - - [26/Aug/2026:18:38:27 +1000] "GET /madalice.com.au.tar HTTP/1.1" 404 36641 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" 20.104.104.62 - - [26/Aug/2026:18:38:30 +1000] "GET /cgi-bin/cloud.php HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.104.62 - - [26/Aug/2026:18:38:32 +1000] "GET /wp-content/updates.php HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.104.62 - - [26/Aug/2026:18:38:35 +1000] "GET /css/cloud.php HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 GET /wp-json/wp/v2/users 2 GET /admin.php 2 GET /about.php 2 GET /aaa.php 1 GET /yj09.php 1 GET /wp-ws68.php 1 GET /wp-theme.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-json/wp/v2/media 1 GET /wp-includes/Text/ 1 GET /wp-includes/Requests/ -- last 10 requests -- 20.151.129.194 - - [26/Aug/2026:18:37:10 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:11 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:11 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:11 +1000] "GET /.well-known/about.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:12 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:12 +1000] "GET /wp-includes/Text/ HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:13 +1000] "GET /ts.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:13 +1000] "GET /bak.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:14 +1000] "GET /olik.php HTTP/1.1" 404 5749 "-" "-" 20.151.129.194 - - [26/Aug/2026:18:37:14 +1000] "GET /about.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- --- last 30 samples (run-up to this incident) --- 2026-08-26 18:36:19 L1=2.51 run=3 blk=0 avail=6818 (58.1%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=200 ap=22 tcp=23 topuser=madalice 2026-08-26 18:36:19 L1=2.51 run=4 blk=0 avail=6810 (58.1%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=208 ap=22 tcp=22 topuser=madalice 2026-08-26 18:36:29 L1=2.59 run=5 blk=0 avail=6700 (57.1%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=339 ap=24 tcp=29 topuser=evolution 2026-08-26 18:36:29 L1=2.59 run=6 blk=0 avail=6753 (57.6%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=252 ap=24 tcp=29 topuser=evolution 2026-08-26 18:36:39 L1=2.57 run=4 blk=0 avail=6644 (56.6%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=379 ap=26 tcp=26 topuser=madalice 2026-08-26 18:36:39 L1=2.57 run=3 blk=0 avail=6631 (56.5%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=392 ap=26 tcp=26 topuser=madalice 2026-08-26 18:36:49 L1=2.48 run=4 blk=0 avail=6699 (57.1%) swpO=0 conn=3 myRSS=2427 php=4 phpRSS=364 ap=22 tcp=21 topuser=madalice 2026-08-26 18:36:49 L1=2.48 run=7 blk=0 avail=6675 (56.9%) swpO=0 conn=3 myRSS=2427 php=4 phpRSS=421 ap=22 tcp=21 topuser=madalice 2026-08-26 18:36:59 L1=2.48 run=3 blk=0 avail=6669 (56.9%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=387 ap=22 tcp=23 topuser=evolution 2026-08-26 18:36:59 L1=2.48 run=4 blk=0 avail=6717 (57.3%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=299 ap=22 tcp=22 topuser=evolution 2026-08-26 18:37:09 L1=2.41 run=4 blk=0 avail=6914 (58.9%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=68 ap=23 tcp=22 topuser=madalice 2026-08-26 18:37:09 L1=2.41 run=2 blk=0 avail=6908 (58.9%) swpO=0 conn=3 myRSS=2427 php=1 phpRSS=72 ap=23 tcp=24 topuser=madalice 2026-08-26 18:37:19 L1=2.27 run=4 blk=0 avail=6791 (57.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=231 ap=23 tcp=24 topuser=evolution 2026-08-26 18:37:19 L1=2.27 run=3 blk=0 avail=6779 (57.8%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=242 ap=23 tcp=24 topuser=evolution 2026-08-26 18:37:29 L1=2.38 run=3 blk=0 avail=6668 (56.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=360 ap=23 tcp=19 topuser=madalice 2026-08-26 18:37:29 L1=2.38 run=3 blk=0 avail=6662 (56.8%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=377 ap=23 tcp=18 topuser=madalice 2026-08-26 18:37:39 L1=2.16 run=3 blk=0 avail=6786 (57.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=258 ap=20 tcp=21 topuser=madalice 2026-08-26 18:37:39 L1=2.16 run=2 blk=0 avail=6769 (57.7%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=270 ap=20 tcp=21 topuser=madalice 2026-08-26 18:37:49 L1=1.83 run=3 blk=0 avail=6814 (58.1%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=153 ap=20 tcp=22 topuser=madalice 2026-08-26 18:37:49 L1=1.83 run=2 blk=0 avail=6807 (58.0%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=160 ap=20 tcp=22 topuser=madalice 2026-08-26 18:37:59 L1=1.93 run=4 blk=0 avail=6868 (58.6%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=103 ap=24 tcp=24 topuser=madalice 2026-08-26 18:38:00 L1=1.93 run=3 blk=0 avail=6836 (58.3%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=131 ap=24 tcp=24 topuser=madalice 2026-08-26 18:38:10 L1=1.87 run=4 blk=0 avail=6560 (55.9%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=449 ap=22 tcp=27 topuser=corpkicks 2026-08-26 18:38:10 L1=1.87 run=5 blk=0 avail=6541 (55.8%) swpO=0 conn=2 myRSS=2427 php=3 phpRSS=471 ap=22 tcp=27 topuser=corpkicks 2026-08-26 18:38:20 L1=1.81 run=2 blk=0 avail=6821 (58.2%) swpO=0 conn=3 myRSS=2427 php=1 phpRSS=149 ap=19 tcp=24 topuser=madalice 2026-08-26 18:38:20 L1=1.81 run=2 blk=0 avail=6815 (58.1%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=164 ap=19 tcp=24 topuser=madalice 2026-08-26 18:38:30 L1=2.40 run=8 blk=0 avail=5977 (51.0%) swpO=737 conn=3 myRSS=2410 php=5 phpRSS=966 ap=48 tcp=48 topuser=madalice 2026-08-26 18:38:30 L1=2.40 run=6 blk=0 avail=5928 (50.5%) swpO=737 conn=2 myRSS=2410 php=5 phpRSS=1025 ap=48 tcp=48 topuser=madalice 2026-08-26 18:38:40 L1=2.33 run=21 blk=0 avail=4987 (42.5%) swpO=0 conn=15 myRSS=2410 php=13 phpRSS=2292 ap=38 tcp=35 topuser=madalice 2026-08-26 18:38:40 L1=2.33 run=16 blk=0 avail=5047 (43.0%) swpO=0 conn=15 myRSS=2410 php=13 phpRSS=2241 ap=38 tcp=35 topuser=madalice 2026-08-26 18:36:19 L1=2.51 run=3 blk=0 avail=6818 (58.1%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=200 ap=22 tcp=23 topuser=madalice 2026-08-26 18:36:19 L1=2.51 run=4 blk=0 avail=6810 (58.1%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=208 ap=22 tcp=22 topuser=madalice 2026-08-26 18:36:29 L1=2.59 run=5 blk=0 avail=6700 (57.1%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=339 ap=24 tcp=29 topuser=evolution 2026-08-26 18:36:29 L1=2.59 run=6 blk=0 avail=6753 (57.6%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=252 ap=24 tcp=29 topuser=evolution 2026-08-26 18:36:39 L1=2.57 run=4 blk=0 avail=6644 (56.6%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=379 ap=26 tcp=26 topuser=madalice 2026-08-26 18:36:39 L1=2.57 run=3 blk=0 avail=6631 (56.5%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=392 ap=26 tcp=26 topuser=madalice 2026-08-26 18:36:49 L1=2.48 run=4 blk=0 avail=6699 (57.1%) swpO=0 conn=3 myRSS=2427 php=4 phpRSS=364 ap=22 tcp=21 topuser=madalice 2026-08-26 18:36:49 L1=2.48 run=7 blk=0 avail=6675 (56.9%) swpO=0 conn=3 myRSS=2427 php=4 phpRSS=421 ap=22 tcp=21 topuser=madalice 2026-08-26 18:36:59 L1=2.48 run=3 blk=0 avail=6669 (56.9%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=387 ap=22 tcp=23 topuser=evolution 2026-08-26 18:36:59 L1=2.48 run=4 blk=0 avail=6717 (57.3%) swpO=0 conn=3 myRSS=2427 php=2 phpRSS=299 ap=22 tcp=22 topuser=evolution 2026-08-26 18:37:09 L1=2.41 run=4 blk=0 avail=6914 (58.9%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=68 ap=23 tcp=22 topuser=madalice 2026-08-26 18:37:09 L1=2.41 run=2 blk=0 avail=6908 (58.9%) swpO=0 conn=3 myRSS=2427 php=1 phpRSS=72 ap=23 tcp=24 topuser=madalice 2026-08-26 18:37:19 L1=2.27 run=4 blk=0 avail=6791 (57.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=231 ap=23 tcp=24 topuser=evolution 2026-08-26 18:37:19 L1=2.27 run=3 blk=0 avail=6779 (57.8%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=242 ap=23 tcp=24 topuser=evolution 2026-08-26 18:37:29 L1=2.38 run=3 blk=0 avail=6668 (56.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=360 ap=23 tcp=19 topuser=madalice 2026-08-26 18:37:29 L1=2.38 run=3 blk=0 avail=6662 (56.8%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=377 ap=23 tcp=18 topuser=madalice 2026-08-26 18:37:39 L1=2.16 run=3 blk=0 avail=6786 (57.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=258 ap=20 tcp=21 topuser=madalice 2026-08-26 18:37:39 L1=2.16 run=2 blk=0 avail=6769 (57.7%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=270 ap=20 tcp=21 topuser=madalice 2026-08-26 18:37:49 L1=1.83 run=3 blk=0 avail=6814 (58.1%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=153 ap=20 tcp=22 topuser=madalice 2026-08-26 18:37:49 L1=1.83 run=2 blk=0 avail=6807 (58.0%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=160 ap=20 tcp=22 topuser=madalice 2026-08-26 18:37:59 L1=1.93 run=4 blk=0 avail=6868 (58.6%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=103 ap=24 tcp=24 topuser=madalice 2026-08-26 18:38:00 L1=1.93 run=3 blk=0 avail=6836 (58.3%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=131 ap=24 tcp=24 topuser=madalice 2026-08-26 18:38:10 L1=1.87 run=4 blk=0 avail=6560 (55.9%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=449 ap=22 tcp=27 topuser=corpkicks 2026-08-26 18:38:10 L1=1.87 run=5 blk=0 avail=6541 (55.8%) swpO=0 conn=2 myRSS=2427 php=3 phpRSS=471 ap=22 tcp=27 topuser=corpkicks 2026-08-26 18:38:20 L1=1.81 run=2 blk=0 avail=6821 (58.2%) swpO=0 conn=3 myRSS=2427 php=1 phpRSS=149 ap=19 tcp=24 topuser=madalice 2026-08-26 18:38:20 L1=1.81 run=2 blk=0 avail=6815 (58.1%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=164 ap=19 tcp=24 topuser=madalice 2026-08-26 18:38:30 L1=2.40 run=8 blk=0 avail=5977 (51.0%) swpO=737 conn=3 myRSS=2410 php=5 phpRSS=966 ap=48 tcp=48 topuser=madalice 2026-08-26 18:38:30 L1=2.40 run=6 blk=0 avail=5928 (50.5%) swpO=737 conn=2 myRSS=2410 php=5 phpRSS=1025 ap=48 tcp=48 topuser=madalice 2026-08-26 18:38:40 L1=2.33 run=21 blk=0 avail=4987 (42.5%) swpO=0 conn=15 myRSS=2410 php=13 phpRSS=2292 ap=38 tcp=35 topuser=madalice 2026-08-26 18:38:40 L1=2.33 run=16 blk=0 avail=5047 (43.0%) swpO=0 conn=15 myRSS=2410 php=13 phpRSS=2241 ap=38 tcp=35 topuser=madalice