INCIDENT 2026-08-27 04:47:44 trigger: php_rss=1686MB ================================================================== load: 2.12 1.31 1.33 12/661 89654 ncpu:10 mem_avail: 5756MB/11729MB (49.1%) swap_used:2165MB swapout:0/s blocked(D):0 running:14 iowait:0.0% steal:0.0% php: 10 procs / 1686MB heaviest user: madalice (9 procs, 1520MB) apache: 21 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2351 madalice 9 1670 root 237 975 nobody 20 316 netdata 8 259 cpanellogin 1 63 mailman 20 55 dovenull 6 43 infinium 3 42 lowrange 2 29 kurri 2 21 wp-toolkit 6 19 dovecot 3 16 aaa 1 15 zabbix 1 14 evolution 6 7 nscd 1 6 named 1 6 cpanelconnecttrack 1 3 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB mysql 1 2351 madalice 9 1680 root 238 976 nobody 20 316 netdata 8 259 cpanellogin 1 63 mailman 20 55 dovenull 6 43 infinium 3 42 lowrange 2 29 kurri 2 21 wp-toolkit 6 19 dovecot 3 16 aaa 1 15 zabbix 1 14 evolution 6 7 nscd 1 6 named 1 6 cpanelconnecttrack 1 3 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 9 1689 --- vm tuning / memory pressure --- madalice 9 1699 vm.swappiness 30 --- vm tuning / memory pressure --- vm.vfs_cache_pressure 100 vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_memory 0 vm.overcommit_ratio 50 vm.overcommit_ratio 50 Cached: 5997 MB Active(file): 4278 MB Inactive(file): 910 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 526 MB CommitLimit: 9960 MB Committed_AS: 8341 MB Cached: 5998 MB Active(file): 4278 MB Inactive(file): 910 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 526 MB CommitLimit: 9960 MB Committed_AS: 8341 MB --- backup / dump / scan processes (page-cache evictors) --- --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND PID USER ELAPSED RSS_KB COMMAND 3565593 root 03:36:28 11468 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- 3565593 root 03:36:28 11444 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2403368 13.8 Ssl 2-01:16:28 /usr/sbin/mariadbd 89585 88865 madalice 251740 69.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89586 89421 madalice 250296 104 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89584 88770 madalice 238884 70.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89589 74085 madalice 233816 99.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89587 74498 madalice 216412 98.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 208328 2.5 Ssl 58-18:37:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 89588 74402 madalice 196780 89.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89592 72058 madalice 195588 86.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89591 72114 madalice 192804 84.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3846466 3797563 root 187480 0.0 S 02:12:10 spamd child 3797563 1 root 175656 0.0 Ss 02:24:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3846467 3797563 root 168332 0.0 S 02:12:10 spamd child 89593 71867 madalice 167740 74.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 166456 0.0 Ss 11-20:57:15 /usr/lib/systemd/systemd-journald 4082167 1353308 cpanellogin 64936 0.0 S 58:44 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1353308 1 root 42696 0.0 Ss 36-02:06:24 cpsrvd (SSL) - waiting for connections 89673 88524 evolution 40872 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 40468 0.0 Sl 58-18:37:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 36160 0.1 Sl 58-18:37:49 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3797007 1 root 31860 0.0 Ss 02:25:22 lfd - sleeping 72058 1276780 nobody 22040 0.0 S 06:40 /usr/sbin/httpd -k start 73484 1276780 nobody 21180 0.0 S 04:49 /usr/sbin/httpd -k start 72114 1276780 nobody 20792 0.0 S 06:39 /usr/sbin/httpd -k start 88865 1276780 nobody 20352 0.0 S 01:23 /usr/sbin/httpd -k start 185104 2431 netdata 19956 2.1 Sl 14-08:14:12 /usr/libexec/netdata/plugins.d/apps.plugin 1 1469 1 root 19780 0.1 Ss 58-18:37:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 74152 1276780 nobody 19648 0.0 S 03:39 /usr/sbin/httpd -k start 74085 1276780 nobody 18740 0.0 S 03:42 /usr/sbin/httpd -k start 88524 1276780 nobody 18680 0.0 S 02:04 /usr/sbin/httpd -k start 74498 1276780 nobody 18676 0.0 S 03:00 /usr/sbin/httpd -k start 71867 1276780 nobody 18672 0.1 S 06:50 /usr/sbin/httpd -k start 74402 1276780 nobody 17852 0.0 S 03:05 /usr/sbin/httpd -k start 73478 1276780 nobody 17664 0.0 S 04:50 /usr/sbin/httpd -k start 74390 1276780 nobody 17652 0.0 S 03:06 /usr/sbin/httpd -k start 88864 1276780 nobody 17444 0.0 S 01:23 /usr/sbin/httpd -k start 88770 1276780 nobody 17320 0.0 S 01:34 /usr/sbin/httpd -k start 89421 1276780 nobody 17204 0.0 S 00:28 /usr/sbin/httpd -k start 73191 1471 root 16496 0.0 S 05:06 cPhulkd - dbprocessor 3348025 3828812 aaa 16076 0.0 S 04:37:48 dovecot/imap 1471 1 root 15596 0.0 Ss 58-18:37:53 cPhulkd - processor 73193 1471 root 15184 0.0 S 05:06 cPhulkd - processor - http socket 3295375 3828812 lowrange 15140 0.0 S 04:56:18 dovecot/imap 1204 1 zabbix 15000 0.2 Ssl 58-18:37:54 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3355510 3828812 lowrange 14936 0.0 S 04:37:38 dovecot/imap 1463 1 root 14792 0.0 Ss 58-18:37:53 tailwatchd 4081203 3828812 infinium 14684 0.0 S 01:00:33 dovecot/imap 39110 3828812 infinium 14436 0.0 S 15:55 dovecot/imap 89580 3828812 kurri 14392 0.0 S 00:04 dovecot/imap 56460 3828812 infinium 14376 0.0 S 09:55 dovecot/imap 89431 3828812 root 12596 0.0 S 00:24 dovecot/auth -w 3565593 1 root 11420 0.0 Ssl 03:36:28 /usr/bin/imunify-agent-proxy 89590 1276780 nobody 11408 0.0 S 00:02 /usr/sbin/httpd -k start 89595 1276780 nobody 11408 0.0 S 00:01 /usr/sbin/httpd -k start 89596 1276780 nobody 11408 0.0 S 00:01 /usr/sbin/httpd -k start 2937469 1 root 10760 0.0 Ss 1-02:25:11 queueprocd - waiting up to 60s to process a task 1780156 3828812 dovenull 10564 0.0 S 2-04:14:54 dovecot/imap-login 1780152 3828812 dovenull 10048 0.0 S 2-04:14:54 dovecot/imap-login 1780154 3828812 dovenull 8556 0.0 S 2-04:14:54 dovecot/pop3-login 1780162 3828812 dovecot 8500 0.0 S 2-04:14:54 dovecot/auth --- processes in D state (uninterruptible IO) --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2403368 13.8 Ssl 2-01:16:28 /usr/sbin/mariadbd 89585 88865 madalice 251740 69.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89586 89421 madalice 250296 104 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89584 88770 madalice 238884 70.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89589 74085 madalice 233816 99.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89587 74498 madalice 216412 98.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 208328 2.5 Ssl 58-18:37:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 89588 74402 madalice 196780 89.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89592 72058 madalice 196116 86.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 89591 72114 madalice 193216 84.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3846466 3797563 root 187480 0.0 S 02:12:10 spamd child 3797563 1 root 175656 0.0 Ss 02:24:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 89593 71867 madalice 168532 74.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3846467 3797563 root 168332 0.0 S 02:12:10 spamd child 2575382 1 root 166456 0.0 Ss 11-20:57:15 /usr/lib/systemd/systemd-journald 4082167 1353308 cpanellogin 64936 0.0 S 58:44 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1353308 1 root 42696 0.0 Ss 36-02:06:24 cpsrvd (SSL) - waiting for connections 89673 88524 evolution 40872 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 40468 0.0 Sl 58-18:37:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 36160 0.1 Sl 58-18:37:49 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3797007 1 root 31860 0.0 Ss 02:25:22 lfd - sleeping 72058 1276780 nobody 22040 0.0 S 06:40 /usr/sbin/httpd -k start 73484 1276780 nobody 21180 0.0 S 04:49 /usr/sbin/httpd -k start 72114 1276780 nobody 20792 0.0 S 06:39 /usr/sbin/httpd -k start 88865 1276780 nobody 20352 0.0 S 01:23 /usr/sbin/httpd -k start 185104 2431 netdata 19956 2.1 Sl 14-08:14:12 /usr/libexec/netdata/plugins.d/apps.plugin 1 1469 1 root 19780 0.1 Ss 58-18:37:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 74152 1276780 nobody 19648 0.0 S 03:39 /usr/sbin/httpd -k start 74085 1276780 nobody 18740 0.0 S 03:42 /usr/sbin/httpd -k start 88524 1276780 nobody 18680 0.0 S 02:04 /usr/sbin/httpd -k start 74498 1276780 nobody 18676 0.0 S 03:00 /usr/sbin/httpd -k start 71867 1276780 nobody 18672 0.1 S 06:50 /usr/sbin/httpd -k start 74402 1276780 nobody 17852 0.0 S 03:05 /usr/sbin/httpd -k start 73478 1276780 nobody 17664 0.0 S 04:50 /usr/sbin/httpd -k start 74390 1276780 nobody 17652 0.0 S 03:06 /usr/sbin/httpd -k start 88864 1276780 nobody 17444 0.0 S 01:23 /usr/sbin/httpd -k start 88770 1276780 nobody 17320 0.0 S 01:34 /usr/sbin/httpd -k start 89421 1276780 nobody 17204 0.0 S 00:28 /usr/sbin/httpd -k start 73191 1471 root 16496 0.0 S 05:06 cPhulkd - dbprocessor 3348025 3828812 aaa 16076 0.0 S 04:37:48 dovecot/imap 1471 1 root 15596 0.0 Ss 58-18:37:53 cPhulkd - processor 73193 1471 root 15184 0.0 S 05:06 cPhulkd - processor - http socket 3295375 3828812 lowrange 15140 0.0 S 04:56:18 dovecot/imap 1204 1 zabbix 15000 0.2 Ssl 58-18:37:54 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3355510 3828812 lowrange 14936 0.0 S 04:37:38 dovecot/imap 1463 1 root 14792 0.0 Ss 58-18:37:53 tailwatchd 4081203 3828812 infinium 14684 0.0 S 01:00:33 dovecot/imap 39110 3828812 infinium 14436 0.0 S 15:55 dovecot/imap 89580 3828812 kurri 14392 0.0 S 00:04 dovecot/imap 56460 3828812 infinium 14376 0.0 S 09:55 dovecot/imap 89431 3828812 root 12596 0.0 S 00:24 dovecot/auth -w 3565593 1 root 11420 0.0 Ssl 03:36:28 /usr/bin/imunify-agent-proxy 89590 1276780 nobody 11408 0.0 S 00:02 /usr/sbin/httpd -k start 89595 1276780 nobody 11408 0.0 S 00:01 /usr/sbin/httpd -k start 89596 1276780 nobody 11408 0.0 S 00:01 /usr/sbin/httpd -k start 2937469 1 root 10760 0.0 Ss 1-02:25:11 queueprocd - waiting up to 60s to process a task 1780156 3828812 dovenull 10564 0.0 S 2-04:14:54 dovecot/imap-login 1780152 3828812 dovenull 10048 0.0 S 2-04:14:54 dovecot/imap-login 1780154 3828812 dovenull 8556 0.0 S 2-04:14:54 dovecot/pop3-login 1780162 3828812 dovecot 8500 0.0 S 2-04:14:54 dovecot/auth --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9068199 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9068201 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 121 evolution/my.evolutionerp.com.au-ssl_log 90 customc/customcentral.com.au 82 lowrange/lowrange.com.au-ssl_log 80 customc/customcentral.com.au-ssl_log 121 evolution/portal.evolutionerp.com.au-ssl_log 21 alison/alisonarts.com.au-ssl_log 10 evolution/my.evolutionerp.com.au-ssl_log 90 madalice/madalice.com.au-ssl_log 6 customc/customcentral.com.au 82 lowrange/lowrange.com.au-ssl_log 80 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- evolution/portal.evolutionerp.com.au-ssl_log 21 alison/alisonarts.com.au-ssl_log 10 madalice/madalice.com.au-ssl_log 6 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 198 68.155.159.216 85 103.104.165.99 79 52.139.37.240 21 203.54.180.238 3 52.203.42.156 3 40.77.167.50 3 118.127.40.55 2 52.167.144.166 2 34.140.248.244 2 2a01:cb05:972a:9700:c5db:80ec:8d0b:bbcb 1 91.185.10.142 1 20.100.175.163 1 191.15.100.156 1 185.174.208.141 1 181.59.148.86 --- top request paths across all vhosts (last 3 min) --- 198 68.155.159.216 85 103.104.165.99 79 52.139.37.240 21 203.54.180.238 3 52.203.42.156 3 40.77.167.50 3 118.127.40.55 2 52.167.144.166 2 34.140.248.244 2 2a01:cb05:972a:9700:c5db:80ec:8d0b:bbcb 1 91.185.10.142 1 20.100.175.163 1 191.15.100.156 1 185.174.208.141 1 181.59.148.86 --- top request paths across all vhosts (last 3 min) --- 24 GET /app/ajax.php 21 GET /heartbeat.php 18 GET /app/templates/ajax.php 14 GET /index.php 9 POST /plugins/csvexporter/plugin.php 8 POST /functions.php 8 GET /wp-login.php 6 POST /clienteditsave.php 6 GET / 5 GET /airbrush-news/airbrushed-kokoda-caravan-two-up-xl-australian-army-theme-happy-caravaners/ 3 POST /wp-cron.php 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 3 POST /app/ajax/selectFilterSingle.php 3 GET /wp.php 3 GET /wp-content/index.php 3 GET /store/design-your-own-send-in/ 3 GET /edit.php 3 GET /as.php 2 POST /app/ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 5 GET /wp-login.php 3 POST /wp-cron.php 2 GET / 1 GET /zwso.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/SimplePie/ 1 GET /wp-includes/Requests/library/about.php 1 GET /wp-includes/Requests/chosen.php 1 GET /wp-includes/Requests/about.php -- last 10 requests -- 24 GET /app/ajax.php 21 GET /heartbeat.php 18 GET /app/templates/ajax.php 14 GET /index.php 9 POST /plugins/csvexporter/plugin.php 8 POST /functions.php 8 GET /wp-login.php 6 POST /clienteditsave.php 6 GET / 5 GET /airbrush-news/airbrushed-kokoda-caravan-two-up-xl-australian-army-theme-happy-caravaners/ 3 POST /wp-cron.php 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 3 POST /app/ajax/selectFilterSingle.php 3 GET /wp.php 3 GET /wp-content/index.php 3 GET /store/design-your-own-send-in/ 3 GET /edit.php 3 GET /as.php 2 POST /app/ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 68.155.159.216 - - [27/Aug/2026:04:47:27 +1000] "GET /wp-includes/css/about.php HTTP/1.1" 404 73297 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:28 +1000] "GET /files/index.php HTTP/1.1" 301 - "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:29 +1000] "GET /files/ HTTP/1.1" 404 73275 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:31 +1000] "GET /wp-admin/network/admin.php HTTP/1.1" 302 - "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:32 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fcustomcentral.com.au%2Fwp-admin%2Fnetwork%2Fadmin.php&reauth=1 HTTP/1.1" 200 6971 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:33 +1000] "GET /wp-includes/Requests/about.php HTTP/1.1" 404 73302 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:35 +1000] "GET /wp-includes/widgets/about.php HTTP/1.1" 404 73301 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:36 +1000] "GET /wp-admin/css/colors/coffee/index.php HTTP/1.1" 301 - "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:37 +1000] "GET /wp-admin/css/colors/coffee/ HTTP/1.1" 404 73299 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:38 +1000] "GET /wp-includes/fonts/wp-login.php HTTP/1.1" 404 73302 "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 5 GET /wp-login.php 3 POST /wp-cron.php 2 GET / 1 GET /zwso.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/SimplePie/ 1 GET /wp-includes/Requests/library/about.php 1 GET /wp-includes/Requests/chosen.php 1 GET /wp-includes/Requests/about.php -- last 10 requests -- 24 GET /app/ajax.php 18 GET /app/templates/ajax.php 14 GET /index.php 9 POST /plugins/csvexporter/plugin.php 8 POST /functions.php 6 POST /clienteditsave.php 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 3 POST /app/ajax/selectFilterSingle.php 2 POST /app/ajax.php -- last 10 requests -- 68.155.159.216 - - [27/Aug/2026:04:47:27 +1000] "GET /wp-includes/css/about.php HTTP/1.1" 404 73297 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:28 +1000] "GET /files/index.php HTTP/1.1" 301 - "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:29 +1000] "GET /files/ HTTP/1.1" 404 73275 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:31 +1000] "GET /wp-admin/network/admin.php HTTP/1.1" 302 - "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:32 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fcustomcentral.com.au%2Fwp-admin%2Fnetwork%2Fadmin.php&reauth=1 HTTP/1.1" 200 6971 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:33 +1000] "GET /wp-includes/Requests/about.php HTTP/1.1" 404 73302 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:35 +1000] "GET /wp-includes/widgets/about.php HTTP/1.1" 404 73301 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:36 +1000] "GET /wp-admin/css/colors/coffee/index.php HTTP/1.1" 301 - "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:37 +1000] "GET /wp-admin/css/colors/coffee/ HTTP/1.1" 404 73299 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:38 +1000] "GET /wp-includes/fonts/wp-login.php HTTP/1.1" 404 73302 "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 103.104.165.99 - - [27/Aug/2026:04:46:21 +1000] "GET /app/ajax.php?cn=tsExportSettingstimesheet&furi=false&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=15590900943 HTTP/1.1" 200 102 "https://my.evolutionerp.com 103.104.165.99 - - [27/Aug/2026:04:46:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 3802 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11034" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 103.104.165.99 - - [27/Aug/2026:04:46:22 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 23417 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11034" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.165.99 - - [27/Aug/2026:04:46:22 +1000] "GET /index.php?modules=projects&page=deliveries&runsheet_date=2026-08-31&branch=1 HTTP/1.1" 200 22324 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliv 103.104.165.99 - - [27/Aug/2026:04:46:23 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-08-31&branch=1" "Mozill 103.104.165.99 - - [27/Aug/2026:04:46:23 +1000] "GET /app/ajax.php?cn=&furi=true&uri=modules%3Dprojects%26page%3Ddeliveries%26runsheet_date%3D2026-08-31%26branch%3D1&call=getUserSetting&caller=ajaxSubmitLocal&seq=1295262 103.104.165.99 - - [27/Aug/2026:04:46:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-08-31&branch=1" "Mozilla 52.167.144.166 - - [27/Aug/2026:04:46:59 +1000] "GET /index.php?page=activities&keyword=asus%E7%AD%86%E9%9B%BB+copilot%E9%8D%B5%E6%9B%B4%E6%94%B9%E5%8A%9F%E8%83%BD HTTP/1.1" 200 5324 "-" "Mozilla/5.0 AppleWebKit/537.36 ( 40.77.167.50 - - [27/Aug/2026:04:47:03 +1000] "GET /index.php?page=jobedit&id=29394 HTTP/1.1" 200 5265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Ch 40.77.167.50 - - [27/Aug/2026:04:47:04 +1000] "GET /index.php?page=pickingedit&pickingid=37717 HTTP/1.1" 200 5260 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bing == customc/customcentral.com.au == -- top paths -- 24 GET /app/ajax.php 18 GET /app/templates/ajax.php 14 GET /index.php 9 POST /plugins/csvexporter/plugin.php 8 POST /functions.php 6 POST /clienteditsave.php 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 3 POST /app/ajax/selectFilterSingle.php 2 POST /app/ajax.php -- last 10 requests -- 103.104.165.99 - - [27/Aug/2026:04:46:21 +1000] "GET /app/ajax.php?cn=tsExportSettingstimesheet&furi=false&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=15590900943 HTTP/1.1" 200 102 "https://my.evolutionerp.com 103.104.165.99 - - [27/Aug/2026:04:46:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 3802 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11034" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 103.104.165.99 - - [27/Aug/2026:04:46:22 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 23417 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11034" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.165.99 - - [27/Aug/2026:04:46:22 +1000] "GET /index.php?modules=projects&page=deliveries&runsheet_date=2026-08-31&branch=1 HTTP/1.1" 200 22324 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliv 103.104.165.99 - - [27/Aug/2026:04:46:23 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-08-31&branch=1" "Mozill 103.104.165.99 - - [27/Aug/2026:04:46:23 +1000] "GET /app/ajax.php?cn=&furi=true&uri=modules%3Dprojects%26page%3Ddeliveries%26runsheet_date%3D2026-08-31%26branch%3D1&call=getUserSetting&caller=ajaxSubmitLocal&seq=1295262 103.104.165.99 - - [27/Aug/2026:04:46:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-08-31&branch=1" "Mozilla 52.167.144.166 - - [27/Aug/2026:04:46:59 +1000] "GET /index.php?page=activities&keyword=asus%E7%AD%86%E9%9B%BB+copilot%E9%8D%B5%E6%9B%B4%E6%94%B9%E5%8A%9F%E8%83%BD HTTP/1.1" 200 5324 "-" "Mozilla/5.0 AppleWebKit/537.36 ( 40.77.167.50 - - [27/Aug/2026:04:47:03 +1000] "GET /index.php?page=jobedit&id=29394 HTTP/1.1" 200 5265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Ch 40.77.167.50 - - [27/Aug/2026:04:47:04 +1000] "GET /index.php?page=pickingedit&pickingid=37717 HTTP/1.1" 200 5260 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bing == customc/customcentral.com.au == -- top paths -- 1 GET /zwso.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-login.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/Requests/library/about.php 1 GET /wp-includes/Requests/chosen.php 1 GET /wp-includes/pomo/fgertreyersd.php 1 GET /wp-includes/pomo/about.php 1 GET /wp-includes/IXR/allez.php 1 GET /wp-includes/buy.php 1 GET /wp-includes/assets/index.php 1 GET /zwso.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-login.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/Requests/library/about.php 1 GET /wp-includes/Requests/chosen.php 1 GET /wp-includes/pomo/fgertreyersd.php 1 GET /wp-includes/pomo/about.php 1 GET /wp-includes/IXR/allez.php 1 GET /wp-includes/buy.php 1 GET /wp-includes/assets/index.php -- last 10 requests -- -- last 10 requests -- 68.155.159.216 - - [27/Aug/2026:04:46:52 +1000] "GET /.well-known/index.php HTTP/1.1" 301 298 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:52 +1000] "GET /asasx.php HTTP/1.1" 301 286 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:54 +1000] "GET /wp-admin/user/wp-login.php HTTP/1.1" 301 303 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:55 +1000] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" 301 311 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:58 +1000] "GET /wp-content/radio.php HTTP/1.1" 301 297 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:59 +1000] "GET /wp-content/plugins/about.php HTTP/1.1" 301 305 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:01 +1000] "GET /st.php HTTP/1.1" 301 283 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:02 +1000] "GET /wp-content/about.php HTTP/1.1" 301 297 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:04 +1000] "GET /wp-admin/admin.php HTTP/1.1" 301 295 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:07 +1000] "GET /wp-admin/css/admin.php HTTP/1.1" 301 299 "-" "-" --- last 30 samples (run-up to this incident) --- 68.155.159.216 - - [27/Aug/2026:04:46:52 +1000] "GET /.well-known/index.php HTTP/1.1" 301 298 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:52 +1000] "GET /asasx.php HTTP/1.1" 301 286 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:54 +1000] "GET /wp-admin/user/wp-login.php HTTP/1.1" 301 303 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:55 +1000] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" 301 311 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:58 +1000] "GET /wp-content/radio.php HTTP/1.1" 301 297 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:46:59 +1000] "GET /wp-content/plugins/about.php HTTP/1.1" 301 305 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:01 +1000] "GET /st.php HTTP/1.1" 301 283 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:02 +1000] "GET /wp-content/about.php HTTP/1.1" 301 297 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:04 +1000] "GET /wp-admin/admin.php HTTP/1.1" 301 295 "-" "-" 68.155.159.216 - - [27/Aug/2026:04:47:07 +1000] "GET /wp-admin/css/admin.php HTTP/1.1" 301 299 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-27 04:45:23 L1=1.41 run=2 blk=0 avail=7028 (59.9%) swpO=0 conn=2 myRSS=2351 php=2 phpRSS=103 ap=20 tcp=29 topuser=evolution 2026-08-27 04:45:23 L1=1.41 run=3 blk=0 avail=7015 (59.8%) swpO=0 conn=3 myRSS=2351 php=2 phpRSS=120 ap=20 tcp=29 topuser=evolution 2026-08-27 04:45:33 L1=1.35 run=2 blk=0 avail=6938 (59.2%) swpO=0 conn=2 myRSS=2351 php=1 phpRSS=178 ap=19 tcp=25 topuser=customc 2026-08-27 04:45:33 L1=1.35 run=4 blk=0 avail=6930 (59.1%) swpO=0 conn=3 myRSS=2351 php=1 phpRSS=183 ap=19 tcp=25 topuser=customc 2026-08-27 04:45:43 L1=1.37 run=1 blk=0 avail=7083 (60.4%) swpO=0 conn=2 myRSS=2351 php=0 phpRSS=0 ap=20 tcp=32 topuser=- 2026-08-27 04:45:43 L1=1.37 run=2 blk=0 avail=7082 (60.4%) swpO=0 conn=3 myRSS=2351 php=0 phpRSS=0 ap=20 tcp=32 topuser=- 2026-08-27 04:45:53 L1=1.39 run=2 blk=0 avail=6971 (59.4%) swpO=0 conn=2 myRSS=2351 php=1 phpRSS=141 ap=20 tcp=29 topuser=alison 2026-08-27 04:45:53 L1=1.39 run=3 blk=0 avail=6967 (59.4%) swpO=0 conn=3 myRSS=2351 php=1 phpRSS=143 ap=20 tcp=29 topuser=alison 2026-08-27 04:46:03 L1=1.18 run=3 blk=0 avail=6969 (59.4%) swpO=0 conn=2 myRSS=2351 php=1 phpRSS=132 ap=19 tcp=24 topuser=customc 2026-08-27 04:46:03 L1=1.18 run=4 blk=0 avail=7067 (60.3%) swpO=0 conn=1 myRSS=2351 php=0 phpRSS=0 ap=19 tcp=24 topuser=- 2026-08-27 04:46:13 L1=1.16 run=2 blk=0 avail=7021 (59.9%) swpO=0 conn=2 myRSS=2352 php=1 phpRSS=88 ap=20 tcp=30 topuser=customc 2026-08-27 04:46:13 L1=1.16 run=2 blk=0 avail=7014 (59.8%) swpO=0 conn=1 myRSS=2352 php=1 phpRSS=94 ap=20 tcp=30 topuser=customc 2026-08-27 04:46:23 L1=1.29 run=1 blk=0 avail=7069 (60.3%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=21 tcp=32 topuser=- 2026-08-27 04:46:23 L1=1.29 run=3 blk=0 avail=7069 (60.3%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=21 tcp=32 topuser=- 2026-08-27 04:46:33 L1=1.32 run=5 blk=0 avail=6920 (59.0%) swpO=0 conn=1 myRSS=2353 php=3 phpRSS=249 ap=21 tcp=27 topuser=tubesupplies 2026-08-27 04:46:33 L1=1.32 run=6 blk=0 avail=6912 (58.9%) swpO=0 conn=1 myRSS=2353 php=3 phpRSS=258 ap=21 tcp=27 topuser=tubesupplies 2026-08-27 04:46:43 L1=1.27 run=1 blk=0 avail=7105 (60.6%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-27 04:46:43 L1=1.27 run=2 blk=0 avail=7103 (60.6%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-27 04:46:53 L1=1.24 run=2 blk=0 avail=6874 (58.6%) swpO=0 conn=1 myRSS=2353 php=1 phpRSS=264 ap=17 tcp=26 topuser=madalice 2026-08-27 04:46:53 L1=1.24 run=4 blk=0 avail=6872 (58.6%) swpO=0 conn=1 myRSS=2353 php=1 phpRSS=265 ap=17 tcp=26 topuser=madalice 2026-08-27 04:47:03 L1=1.28 run=2 blk=0 avail=7018 (59.8%) swpO=0 conn=1 myRSS=2353 php=1 phpRSS=111 ap=17 tcp=27 topuser=alison 2026-08-27 04:47:03 L1=1.28 run=3 blk=0 avail=7016 (59.8%) swpO=0 conn=2 myRSS=2353 php=1 phpRSS=113 ap=17 tcp=27 topuser=alison 2026-08-27 04:47:13 L1=1.16 run=3 blk=0 avail=6835 (58.3%) swpO=0 conn=1 myRSS=2353 php=3 phpRSS=356 ap=17 tcp=30 topuser=speedlin 2026-08-27 04:47:13 L1=1.16 run=4 blk=0 avail=6829 (58.2%) swpO=0 conn=2 myRSS=2353 php=3 phpRSS=361 ap=17 tcp=30 topuser=speedlin 2026-08-27 04:47:23 L1=1.13 run=4 blk=0 avail=6823 (58.2%) swpO=0 conn=4 myRSS=2353 php=3 phpRSS=357 ap=18 tcp=26 topuser=madalice 2026-08-27 04:47:24 L1=1.13 run=6 blk=0 avail=6812 (58.1%) swpO=0 conn=2 myRSS=2353 php=3 phpRSS=368 ap=18 tcp=26 topuser=madalice 2026-08-27 04:47:34 L1=1.19 run=2 blk=0 avail=6980 (59.5%) swpO=0 conn=4 myRSS=2353 php=1 phpRSS=138 ap=18 tcp=27 topuser=customc 2026-08-27 04:47:34 L1=1.19 run=4 blk=0 avail=6978 (59.5%) swpO=0 conn=2 myRSS=2353 php=1 phpRSS=140 ap=18 tcp=27 topuser=customc 2026-08-27 04:47:44 L1=2.12 run=14 blk=0 avail=5750 (49.0%) swpO=0 conn=12 myRSS=2353 php=10 phpRSS=1675 ap=21 tcp=33 topuser=madalice 2026-08-27 04:47:44 L1=2.12 run=14 blk=0 avail=5756 (49.1%) swpO=0 conn=10 myRSS=2353 php=10 phpRSS=1686 ap=21 tcp=33 topuser=madalice 2026-08-27 04:45:23 L1=1.41 run=2 blk=0 avail=7028 (59.9%) swpO=0 conn=2 myRSS=2351 php=2 phpRSS=103 ap=20 tcp=29 topuser=evolution 2026-08-27 04:45:23 L1=1.41 run=3 blk=0 avail=7015 (59.8%) swpO=0 conn=3 myRSS=2351 php=2 phpRSS=120 ap=20 tcp=29 topuser=evolution 2026-08-27 04:45:33 L1=1.35 run=2 blk=0 avail=6938 (59.2%) swpO=0 conn=2 myRSS=2351 php=1 phpRSS=178 ap=19 tcp=25 topuser=customc 2026-08-27 04:45:33 L1=1.35 run=4 blk=0 avail=6930 (59.1%) swpO=0 conn=3 myRSS=2351 php=1 phpRSS=183 ap=19 tcp=25 topuser=customc 2026-08-27 04:45:43 L1=1.37 run=1 blk=0 avail=7083 (60.4%) swpO=0 conn=2 myRSS=2351 php=0 phpRSS=0 ap=20 tcp=32 topuser=- 2026-08-27 04:45:43 L1=1.37 run=2 blk=0 avail=7082 (60.4%) swpO=0 conn=3 myRSS=2351 php=0 phpRSS=0 ap=20 tcp=32 topuser=- 2026-08-27 04:45:53 L1=1.39 run=2 blk=0 avail=6971 (59.4%) swpO=0 conn=2 myRSS=2351 php=1 phpRSS=141 ap=20 tcp=29 topuser=alison 2026-08-27 04:45:53 L1=1.39 run=3 blk=0 avail=6967 (59.4%) swpO=0 conn=3 myRSS=2351 php=1 phpRSS=143 ap=20 tcp=29 topuser=alison 2026-08-27 04:46:03 L1=1.18 run=3 blk=0 avail=6969 (59.4%) swpO=0 conn=2 myRSS=2351 php=1 phpRSS=132 ap=19 tcp=24 topuser=customc 2026-08-27 04:46:03 L1=1.18 run=4 blk=0 avail=7067 (60.3%) swpO=0 conn=1 myRSS=2351 php=0 phpRSS=0 ap=19 tcp=24 topuser=- 2026-08-27 04:46:13 L1=1.16 run=2 blk=0 avail=7021 (59.9%) swpO=0 conn=2 myRSS=2352 php=1 phpRSS=88 ap=20 tcp=30 topuser=customc 2026-08-27 04:46:13 L1=1.16 run=2 blk=0 avail=7014 (59.8%) swpO=0 conn=1 myRSS=2352 php=1 phpRSS=94 ap=20 tcp=30 topuser=customc 2026-08-27 04:46:23 L1=1.29 run=1 blk=0 avail=7069 (60.3%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=21 tcp=32 topuser=- 2026-08-27 04:46:23 L1=1.29 run=3 blk=0 avail=7069 (60.3%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=21 tcp=32 topuser=- 2026-08-27 04:46:33 L1=1.32 run=5 blk=0 avail=6920 (59.0%) swpO=0 conn=1 myRSS=2353 php=3 phpRSS=249 ap=21 tcp=27 topuser=tubesupplies 2026-08-27 04:46:33 L1=1.32 run=6 blk=0 avail=6912 (58.9%) swpO=0 conn=1 myRSS=2353 php=3 phpRSS=258 ap=21 tcp=27 topuser=tubesupplies 2026-08-27 04:46:43 L1=1.27 run=1 blk=0 avail=7105 (60.6%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-27 04:46:43 L1=1.27 run=2 blk=0 avail=7103 (60.6%) swpO=0 conn=1 myRSS=2353 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-27 04:46:53 L1=1.24 run=2 blk=0 avail=6874 (58.6%) swpO=0 conn=1 myRSS=2353 php=1 phpRSS=264 ap=17 tcp=26 topuser=madalice 2026-08-27 04:46:53 L1=1.24 run=4 blk=0 avail=6872 (58.6%) swpO=0 conn=1 myRSS=2353 php=1 phpRSS=265 ap=17 tcp=26 topuser=madalice 2026-08-27 04:47:03 L1=1.28 run=2 blk=0 avail=7018 (59.8%) swpO=0 conn=1 myRSS=2353 php=1 phpRSS=111 ap=17 tcp=27 topuser=alison 2026-08-27 04:47:03 L1=1.28 run=3 blk=0 avail=7016 (59.8%) swpO=0 conn=2 myRSS=2353 php=1 phpRSS=113 ap=17 tcp=27 topuser=alison 2026-08-27 04:47:13 L1=1.16 run=3 blk=0 avail=6835 (58.3%) swpO=0 conn=1 myRSS=2353 php=3 phpRSS=356 ap=17 tcp=30 topuser=speedlin 2026-08-27 04:47:13 L1=1.16 run=4 blk=0 avail=6829 (58.2%) swpO=0 conn=2 myRSS=2353 php=3 phpRSS=361 ap=17 tcp=30 topuser=speedlin 2026-08-27 04:47:23 L1=1.13 run=4 blk=0 avail=6823 (58.2%) swpO=0 conn=4 myRSS=2353 php=3 phpRSS=357 ap=18 tcp=26 topuser=madalice 2026-08-27 04:47:24 L1=1.13 run=6 blk=0 avail=6812 (58.1%) swpO=0 conn=2 myRSS=2353 php=3 phpRSS=368 ap=18 tcp=26 topuser=madalice 2026-08-27 04:47:34 L1=1.19 run=2 blk=0 avail=6980 (59.5%) swpO=0 conn=4 myRSS=2353 php=1 phpRSS=138 ap=18 tcp=27 topuser=customc 2026-08-27 04:47:34 L1=1.19 run=4 blk=0 avail=6978 (59.5%) swpO=0 conn=2 myRSS=2353 php=1 phpRSS=140 ap=18 tcp=27 topuser=customc 2026-08-27 04:47:44 L1=2.12 run=14 blk=0 avail=5750 (49.0%) swpO=0 conn=12 myRSS=2353 php=10 phpRSS=1675 ap=21 tcp=33 topuser=madalice 2026-08-27 04:47:44 L1=2.12 run=14 blk=0 avail=5756 (49.1%) swpO=0 conn=10 myRSS=2353 php=10 phpRSS=1686 ap=21 tcp=33 topuser=madalice