INCIDENT 2026-08-28 03:15:56 trigger: php_rss=1510MB ================================================================== load: 1.16 1.17 1.18 8/595 716612 ncpu:10 mem_avail: 9357MB/13777MB (67.9%) swap_used:385MB swapout:0/s blocked(D):0 running:8 iowait:0.0% steal:0.0% php: 10 procs / 1510MB heaviest user: madalice (8 procs, 1425MB) apache: 36 procs tcp_estab: 53 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 8 1360 root 252 1210 mysql 1 645 nobody 35 600 mailman 20 412 netdata 7 228 wp-toolkit 3 128 cpanellogin 1 80 infinium 5 71 evolution 5 67 dovenull 6 67 named 1 56 kurri 3 42 mailnull 2 35 zabbix 1 28 dovecot 3 28 polkitd 1 24 aaa 1 15 lowrange 1 14 rpc 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 8 1302 evolution 1 53 root 1 31 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7409 MB Active(file): 4312 MB Inactive(file): 3453 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 704 MB CommitLimit: 10984 MB Committed_AS: 7805 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 57:16 14760 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 661208 2.9 Ssl 56:45 /usr/sbin/mariadbd 716567 510022 madalice 249484 74.0 R 00:03 php-fpm: pool madalice_com_au 529388 527476 root 185984 0.0 S 51:38 spamd child 508924 1 netdata 178852 1.9 Ssl 56:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 716290 510022 madalice 176688 43.1 R 00:45 php-fpm: pool madalice_com_au 527476 1 root 174896 0.1 Ss 53:17 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 529389 527476 root 167456 0.0 S 51:38 spamd child 716535 510022 madalice 160748 59.0 R 00:06 php-fpm: pool madalice_com_au 716315 510022 madalice 160088 39.5 S 00:43 php-fpm: pool madalice_com_au 716563 510022 madalice 158860 59.5 S 00:04 php-fpm: pool madalice_com_au 716566 510022 madalice 158812 74.3 S 00:03 php-fpm: pool madalice_com_au 716570 510022 madalice 137988 77.5 R 00:02 php-fpm: pool madalice_com_au 508149 1353308 cpanellogin 82364 0.1 S 56:30 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 483542 1 wp-toolkit 73464 0.0 Ss 57:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 65000 0.0 Sl 56:11 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 716594 510022 madalice 60204 0.0 R 00:00 php-fpm: pool madalice_com_au 508634 1 named 57376 0.0 Ssl 56:19 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4180059 4180015 evolution 55252 0.0 Ss 03:15:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 483546 1 wp-toolkit 47008 0.0 Ss 57:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 509098 1 root 42216 0.0 Ss 56:12 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 1353308 1 root 41928 0.0 Ss 37-00:34:37 cpsrvd (SSL) - waiting for connections 1469 1 root 41676 0.1 Ss 59-17:06:06 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 482788 1 root 37860 0.0 Ss 58:35 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 526869 1 root 36956 0.0 Ss 53:40 lfd - sleeping 481558 1 root 32008 0.1 Ssl 58:38 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 510022 1 root 31916 0.0 Ss 56:07 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 29364 0.2 Ssl 57:28 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 508591 1 polkitd 25188 0.0 Ssl 56:19 /usr/lib/polkit-1/polkitd --no-debug 1463 1 root 24896 0.0 Ss 59-17:06:06 tailwatchd 685644 506832 nobody 22668 0.0 S 06:10 /usr/sbin/httpd -k start 716645 716578 alison 22644 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 684155 506832 nobody 22592 0.0 S 08:24 /usr/sbin/httpd -k start 508863 508814 mailman 22252 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22236 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22236 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508856 508814 mailman 22160 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22128 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 22084 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22068 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 22048 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 22048 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 21976 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 21976 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 21964 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 21952 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 21948 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 701350 506832 nobody 21920 0.0 S 03:13 /usr/sbin/httpd -k start 508866 508814 mailman 21844 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21816 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 508849 508814 mailman 21780 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508859 508814 mailman 21776 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21776 0.0 S 56:17 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 701361 506832 nobody 21756 0.1 S 03:12 /usr/sbin/httpd -k start 701398 506832 nobody 21344 0.0 S 03:11 /usr/sbin/httpd -k start 699878 506832 nobody 21088 0.0 S 05:25 /usr/sbin/httpd -k start 701359 506832 nobody 20876 0.0 S 03:12 /usr/sbin/httpd -k start 700651 506832 nobody 20840 0.0 S 04:34 /usr/sbin/httpd -k start 701352 506832 nobody 20620 0.0 S 03:13 /usr/sbin/httpd -k start 716316 506832 nobody 20332 0.0 S 00:42 /usr/sbin/httpd -k start 701392 506832 nobody 20328 0.0 S 03:11 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4644 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4637 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (30355,30215,24267,28038,28039,31435,27504,29650,31434,30358,30855,29710,33491,34411,30495,24095,24104,33648,28302,24099,30810,30812,30811,24101,24103,34413,31534,30494,29596,31153,31154,30813,31156,31155,31635,33533,33536, | +------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/portal.evolutionerp.com.au-ssl_log 260 evolution/portal.evolutionerp.com.au 224 coscom/coscom.com.au-ssl_log 62 madalice/madalice.com.au-ssl_log 42 evolution/wp.evolutionerp.com.au 32 alison/alisonarts.com.au-ssl_log 7 customc/customcentral.com.au-ssl_log 3 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 453 4.205.62.107 62 52.139.37.240 32 20.48.147.90 31 203.54.180.238 30 165.154.65.223 4 114.119.137.101 3 82.102.18.190 3 118.127.40.55 2 69.6.220.159 2 54.236.1.126 1 94.206.74.127 1 91.92.243.239 1 4.232.148.111 1 27.67.86.165 1 216.26.237.159 --- top request paths across all vhosts (last 3 min) --- 31 GET /heartbeat.php 6 GET / 4 GET /txets.php 4 GET /ms-edit.php 4 GET /motu.php 4 GET /doc.php 3 GET /wp-info.php 3 GET /wp-access.php 3 GET /ty.php 3 GET /gecko-litespeed.php 3 GET /f35.php 3 GET /aww.php 2 POST /wp-login.php 2 POST /wp-admin/admin-ajax.php 2 POST / 2 GET /zz.php 2 GET /zaza.php 2 GET /xqq.php 2 GET /xp.php 2 GET /xin1.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 31 GET /heartbeat.php 2 GET /txets.php 2 GET /ms-edit.php 2 GET /motu.php 2 GET /doc.php 2 GET /aww.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xqq.php 1 GET /xp.php -- last 10 requests -- 4.205.62.107 - - [28/Aug/2026:03:15:30 +1000] "GET /luJMF.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:30 +1000] "GET /drykl.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:31 +1000] "GET /aws.php HTTP/1.1" 404 - "-" "-" 203.54.180.238 - - [28/Aug/2026:03:15:30 +1000] "GET /heartbeat.php?sentAt=1787850930&bytes=106,144,112,178&_=1787810680390 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 4.205.62.107 - - [28/Aug/2026:03:15:31 +1000] "GET /05.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:31 +1000] "GET /xmy.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:32 +1000] "GET /wp-blog.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:32 +1000] "GET /update.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:33 +1000] "GET /fns.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:33 +1000] "GET /25.php HTTP/1.1" 404 - "-" "-" == evolution/portal.evolutionerp.com.au == -- top paths -- 2 GET /txets.php 2 GET /ms-edit.php 2 GET /motu.php 2 GET /doc.php 1 GET /zz.php 1 GET /zaza.php 1 GET //xza.php 1 GET //xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xin1.php 1 GET /xda.php -- last 10 requests -- 4.205.62.107 - - [28/Aug/2026:03:15:27 +1000] "GET /oc460l3x.php HTTP/1.1" 301 299 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:27 +1000] "GET /wp-content/plugin-install.php HTTP/1.1" 301 316 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:28 +1000] "GET /paypal.php HTTP/1.1" 301 297 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:28 +1000] "GET /chosen.php HTTP/1.1" 301 297 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:29 +1000] "GET /rum.or.php HTTP/1.1" 301 297 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:29 +1000] "GET /loxi-o.php HTTP/1.1" 301 297 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:30 +1000] "GET /luJMF.php HTTP/1.1" 301 296 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:30 +1000] "GET //drykl.php HTTP/1.1" 301 296 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:30 +1000] "GET /aws.php HTTP/1.1" 301 294 "-" "-" 4.205.62.107 - - [28/Aug/2026:03:15:31 +1000] "GET /05.php HTTP/1.1" 301 293 "-" "-" == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-load.php 1 GET /wp-info.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/interactivity-api/index.php 1 GET /wp-includes/index.php 1 GET /wp-includes/images/media/ -- last 10 requests -- 52.139.37.240 - - [28/Aug/2026:03:13:11 +1000] "GET /wp-includes/Text/Diff/Engine/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:11 +1000] "GET /z.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:11 +1000] "GET /f35.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:12 +1000] "GET /file61.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:12 +1000] "GET /mah.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:12 +1000] "GET /mini.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:12 +1000] "GET /system_log.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:12 +1000] "GET /v.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:13 +1000] "GET /wp-admin/css/colors/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:03:13:13 +1000] "GET /wp-admin/images/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-28 03:13:32 L1=1.33 run=3 blk=0 avail=10467(76.0%) swpO=0 conn=4 myRSS=645 php=5 phpRSS=376 ap=27 tcp=47 topuser=alison 2026-08-28 03:13:35 L1=1.22 run=3 blk=0 avail=10610(77.0%) swpO=0 conn=2 myRSS=645 php=3 phpRSS=156 ap=27 tcp=41 topuser=madalice 2026-08-28 03:13:42 L1=1.36 run=2 blk=0 avail=10431(75.7%) swpO=0 conn=4 myRSS=645 php=4 phpRSS=366 ap=27 tcp=46 topuser=madalice 2026-08-28 03:13:45 L1=1.25 run=6 blk=0 avail=10480(76.1%) swpO=0 conn=2 myRSS=645 php=4 phpRSS=289 ap=27 tcp=42 topuser=madalice 2026-08-28 03:13:52 L1=1.23 run=3 blk=0 avail=10288(74.7%) swpO=0 conn=4 myRSS=645 php=6 phpRSS=605 ap=23 tcp=32 topuser=madalice 2026-08-28 03:13:56 L1=1.13 run=3 blk=0 avail=10458(75.9%) swpO=0 conn=2 myRSS=645 php=5 phpRSS=424 ap=19 tcp=34 topuser=madalice 2026-08-28 03:14:02 L1=1.20 run=2 blk=0 avail=10413(75.6%) swpO=0 conn=2 myRSS=645 php=5 phpRSS=482 ap=17 tcp=32 topuser=madalice 2026-08-28 03:14:06 L1=1.19 run=1 blk=0 avail=10503(76.2%) swpO=0 conn=2 myRSS=645 php=4 phpRSS=360 ap=17 tcp=33 topuser=madalice 2026-08-28 03:14:12 L1=1.17 run=2 blk=0 avail=10709(77.7%) swpO=0 conn=2 myRSS=645 php=3 phpRSS=148 ap=17 tcp=36 topuser=evolution 2026-08-28 03:14:16 L1=1.08 run=1 blk=0 avail=10739(77.9%) swpO=0 conn=1 myRSS=645 php=2 phpRSS=85 ap=17 tcp=38 topuser=evolution 2026-08-28 03:14:22 L1=1.07 run=3 blk=0 avail=10705(77.7%) swpO=0 conn=2 myRSS=645 php=3 phpRSS=153 ap=17 tcp=34 topuser=evolution 2026-08-28 03:14:26 L1=1.07 run=1 blk=0 avail=10740(78.0%) swpO=0 conn=1 myRSS=645 php=2 phpRSS=85 ap=17 tcp=34 topuser=evolution 2026-08-28 03:14:32 L1=1.06 run=2 blk=0 avail=10626(77.1%) swpO=0 conn=2 myRSS=645 php=3 phpRSS=218 ap=17 tcp=34 topuser=madalice 2026-08-28 03:14:36 L1=0.97 run=2 blk=0 avail=10623(77.1%) swpO=0 conn=1 myRSS=645 php=3 phpRSS=223 ap=17 tcp=31 topuser=madalice 2026-08-28 03:14:42 L1=0.98 run=1 blk=0 avail=10384(75.4%) swpO=0 conn=2 myRSS=645 php=4 phpRSS=483 ap=17 tcp=33 topuser=madalice 2026-08-28 03:14:46 L1=0.90 run=1 blk=0 avail=10471(76.0%) swpO=0 conn=1 myRSS=645 php=4 phpRSS=395 ap=17 tcp=32 topuser=madalice 2026-08-28 03:14:52 L1=0.83 run=1 blk=0 avail=10477(76.0%) swpO=0 conn=2 myRSS=645 php=4 phpRSS=395 ap=17 tcp=30 topuser=madalice 2026-08-28 03:14:56 L1=0.76 run=2 blk=0 avail=10331(75.0%) swpO=0 conn=1 myRSS=645 php=6 phpRSS=601 ap=16 tcp=33 topuser=madalice 2026-08-28 03:15:02 L1=0.86 run=4 blk=0 avail=10556(76.6%) swpO=0 conn=2 myRSS=645 php=4 phpRSS=302 ap=16 tcp=31 topuser=madalice 2026-08-28 03:15:06 L1=0.87 run=9 blk=0 avail=10328(75.0%) swpO=0 conn=1 myRSS=645 php=5 phpRSS=583 ap=16 tcp=35 topuser=corpkicks 2026-08-28 03:15:12 L1=0.88 run=4 blk=0 avail=10622(77.1%) swpO=0 conn=2 myRSS=645 php=5 phpRSS=282 ap=16 tcp=33 topuser=evolution 2026-08-28 03:15:16 L1=1.05 run=2 blk=0 avail=10354(75.2%) swpO=0 conn=3 myRSS=645 php=7 phpRSS=603 ap=17 tcp=37 topuser=madalice 2026-08-28 03:15:22 L1=1.13 run=1 blk=0 avail=10417(75.6%) swpO=0 conn=2 myRSS=645 php=5 phpRSS=463 ap=18 tcp=35 topuser=madalice 2026-08-28 03:15:26 L1=1.12 run=2 blk=0 avail=10460(75.9%) swpO=0 conn=3 myRSS=645 php=4 phpRSS=396 ap=18 tcp=35 topuser=madalice 2026-08-28 03:15:32 L1=1.11 run=2 blk=0 avail=10455(75.9%) swpO=0 conn=2 myRSS=645 php=4 phpRSS=402 ap=18 tcp=33 topuser=madalice 2026-08-28 03:15:36 L1=1.10 run=2 blk=0 avail=10462(75.9%) swpO=0 conn=3 myRSS=645 php=4 phpRSS=398 ap=18 tcp=34 topuser=madalice 2026-08-28 03:15:42 L1=1.09 run=2 blk=0 avail=10435(75.7%) swpO=0 conn=2 myRSS=645 php=4 phpRSS=418 ap=18 tcp=33 topuser=madalice 2026-08-28 03:15:46 L1=1.00 run=2 blk=0 avail=10407(75.5%) swpO=0 conn=3 myRSS=645 php=4 phpRSS=450 ap=18 tcp=34 topuser=madalice 2026-08-28 03:15:52 L1=1.00 run=3 blk=0 avail=10328(75.0%) swpO=0 conn=2 myRSS=645 php=5 phpRSS=527 ap=21 tcp=36 topuser=madalice 2026-08-28 03:15:56 L1=1.16 run=8 blk=0 avail=9357 (67.9%) swpO=0 conn=7 myRSS=645 php=10 phpRSS=1510 ap=36 tcp=53 topuser=madalice