INCIDENT 2026-08-28 07:15:19 trigger: mysql_conn=19 ================================================================== load: 7.85 3.67 2.13 2/682 1577318 ncpu:10 mem_avail: 8761MB/13777MB (63.6%) swap_used:648MB swapout:0/s blocked(D):0 running:3 iowait:0.5% steal:0.0% php: 5 procs / 446MB heaviest user: madalice (2 procs, 306MB) apache: 100 procs tcp_estab: 41 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 98 1777 mysql 1 1580 root 255 1196 mailman 20 411 madalice 2 306 netdata 7 212 evolution 6 119 wp-toolkit 3 114 cpanellogin 1 90 dovenull 6 62 mailnull 3 45 named 1 38 dovecot 3 26 zabbix 1 25 lowrange 2 25 kurri 2 25 polkitd 1 23 infinium 1 12 rpc 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 2 306 evolution 2 108 root 1 30 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4458 MB Active(file): 2962 MB Inactive(file): 1795 MB Dirty: 7 MB Writeback: 0 MB SReclaimable: 618 MB CommitLimit: 10984 MB Committed_AS: 8568 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 04:56:38 12064 /usr/bin/imunify-agent-proxy 1561859 root 01:43 58948 /opt/imunify360/venv/bin/python3 -m imav.run 1563454 root 00:17 3132 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 1577293 root 00:00 43356 /opt/imunify360/venv/bin/python /opt/imunify360/venv/share/imunify360/scripts/check-detached.py --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 1618692 4.8 Ssl 04:56:07 /usr/sbin/mariadbd 508924 1 netdata 179708 1.9 Ssl 04:55:36 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529388 527476 root 176032 0.0 S 04:51:00 spamd child 1563305 510022 madalice 158532 13.1 S 00:22 php-fpm: pool madalice_com_au 529389 527476 root 158196 0.0 S 04:51:00 spamd child 1563299 510022 madalice 155680 10.5 S 00:24 php-fpm: pool madalice_com_au 527476 1 root 133436 0.0 Ss 04:52:39 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 973642 1353308 cpanellogin 92280 0.0 S 02:52:46 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1563480 1563446 evolution 71340 2.0 Ss 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509236 509098 root 71224 0.0 Sl 04:55:33 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 938582 1 wp-toolkit 66756 0.0 Ss 03:03:10 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1561859 1 root 58948 1.5 Ssl 01:43 /opt/imunify360/venv/bin/python3 -m imav.run 1577293 1563454 root 43620 0.0 R 00:00 /opt/imunify360/venv/bin/python /opt/imunify360/venv/share/imunify360/scripts/check-detached.py 938585 1 wp-toolkit 41396 0.0 Ss 03:03:10 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1353308 1 root 41180 0.0 Ss 37-04:33:59 cpsrvd (SSL) - waiting for connections 4180059 4180015 evolution 40020 0.0 Ss 07:15:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 508634 1 named 39928 0.0 Ssl 04:55:41 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509098 1 root 36124 0.0 Ss 04:55:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 1469 1 root 35760 0.1 Ss 59-21:05:28 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 31160 0.0 Ss 04:55:29 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 526869 1 root 30204 0.0 Ss 04:53:02 lfd - sleeping 481558 1 root 29816 0.1 Ssl 04:58:00 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 509266 1 root 27156 0.0 Ss 04:55:33 /usr/lib/systemd/systemd-journald 483898 1 zabbix 25992 0.2 Ssl 04:56:50 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 938444 1 root 25916 0.0 Ss 03:03:13 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 508591 1 polkitd 23708 0.0 Ssl 04:55:41 /usr/lib/polkit-1/polkitd --no-debug 1559898 506832 nobody 23512 0.1 S 03:48 /usr/sbin/httpd -k start 1463 1 root 23308 0.0 Ss 59-21:05:28 tailwatchd 1559775 506832 nobody 23072 0.0 S 03:50 /usr/sbin/httpd -k start 1559905 506832 nobody 22840 0.0 S 03:48 /usr/sbin/httpd -k start 1559529 506832 nobody 22552 0.0 S 04:12 /usr/sbin/httpd -k start 1559473 506832 nobody 22424 0.0 S 04:13 /usr/sbin/httpd -k start 1560032 506832 nobody 22328 0.0 S 03:43 /usr/sbin/httpd -k start 1559803 506832 nobody 22324 0.0 S 03:49 /usr/sbin/httpd -k start 1559817 506832 nobody 22316 0.0 S 03:49 /usr/sbin/httpd -k start 1553983 506832 nobody 22228 0.0 S 05:10 /usr/sbin/httpd -k start 508863 508814 mailman 22188 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22172 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22172 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 1559735 506832 nobody 22172 0.0 S 03:52 /usr/sbin/httpd -k start 508856 508814 mailman 22096 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22064 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 1559874 506832 nobody 22064 0.0 S 03:48 /usr/sbin/httpd -k start 508864 508814 mailman 22020 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22004 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 21984 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 21984 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 21912 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 21912 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 21900 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 21888 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 21884 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 1559773 506832 nobody 21808 0.0 S 03:50 /usr/sbin/httpd -k start 508866 508814 mailman 21780 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21752 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 1562101 506832 nobody 21732 0.0 S 01:24 /usr/sbin/httpd -k start 508849 508814 mailman 21716 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508859 508814 mailman 21716 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21716 0.0 S 04:55:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 1559893 506832 nobody 21688 0.0 S 03:48 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 1577293 D - /opt/imunify360/venv/bin/python /opt/imunify360/venv/share/imunify360/scripts/check-detached.py --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 209989 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 310 evolution/portal.evolutionerp.com.au-ssl_log 159 alison/alisonarts.com.au-ssl_log 108 olympic/olympicfencing.com.au-ssl_log 95 madalice/madalice.com.au-ssl_log 13 aaa/aaadownunder.com.au-ssl_log 6 corpkicks/corporatekicks.com.au 3 customc/customcentral.com.au-ssl_log 2 tubesupplies/tubesupplies.com.au-ssl_log 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 178 103.104.165.99 168 203.54.180.238 108 213.209.159.84 87 20.220.204.93 59 14.1.95.251 29 175.36.227.212 22 1.145.102.184 7 103.104.164.114 5 167.179.190.3 5 118.127.40.55 3 44.201.248.24 3 20.151.129.194 3 1.145.16.82 2 50.6.200.195 2 35.196.162.79 --- top request paths across all vhosts (last 3 min) --- 91 POST /functions.php 69 GET /app/ajax.php 53 GET /factory_session_checker.php 39 GET /heartbeat.php 36 GET /index.php 27 GET /factory_session_processed_qty.php 26 POST /plugins/csvexporter/plugin.php 26 GET /factory_session_joiner.php 14 POST /clienteditsave.php 13 POST /jobeditsave.php 12 POST /app/ajax/selectFilterSingle.php 11 POST /app/ajax/selectFilter.php 9 POST /app/ajax.php 7 POST /plugins/fencecosting/plugin.php 6 POST /wp-login.php 6 POST /itemModify.php 5 POST /wp-cron.php 4 POST /quoteditsave.php 4 POST /logsave.php 4 POST /dispatchsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 91 POST /functions.php 69 GET /app/ajax.php 29 GET /index.php 26 POST /plugins/csvexporter/plugin.php 14 POST /clienteditsave.php 13 POST /jobeditsave.php 12 POST /app/ajax/selectFilterSingle.php 11 POST /app/ajax/selectFilter.php 9 POST /app/ajax.php 7 POST /plugins/fencecosting/plugin.php 6 POST /itemModify.php 4 POST /quoteditsave.php -- last 10 requests -- 103.104.165.99 - - [28/Aug/2026:07:15:14 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=jobregister&contact=Benjamin+Bradley" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.165.99 - - [28/Aug/2026:07:15:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 977 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportunityid=3184" "Mozilla/5.0 (Windows NT 10.0; Win6 14.1.95.251 - - [28/Aug/2026:07:15:15 +1000] "GET /index.php?page=jobregister HTTP/1.1" 200 17140 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=5043" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap 14.1.95.251 - - [28/Aug/2026:07:15:15 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 4478 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 14.1.95.251 - - [28/Aug/2026:07:15:15 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 2692 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 14.1.95.251 - - [28/Aug/2026:07:15:15 +1000] "GET /app/ajax.php?cn=tsExportSettingsjob&furi=false&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=17593458419 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/index. 14.1.95.251 - - [28/Aug/2026:07:15:15 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobregister&call=getUserSetting&caller=ajaxSubmitLocal&seq=12687462160 HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.php?p 14.1.95.251 - - [28/Aug/2026:07:15:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [28/Aug/2026:07:15:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=33949" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 103.104.165.99 - - [28/Aug/2026:07:15:17 +1000] "GET /index.php?page=clientedit&clientid=3551&tab=clienteditgeneral HTTP/1.1" 200 54629 "https://my.evolutionerp.com.au/index.php?page=clientlist" "Mozilla/5.0 (Windows NT == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 53 GET /factory_session_checker.php 39 GET /heartbeat.php 27 GET /factory_session_processed_qty.php 26 GET /factory_session_joiner.php 7 GET /index.php 3 POST /factory_functions.php 2 POST /portal/register 1 POST /inventory.php 1 GET /uploadsave.php -- last 10 requests -- 203.54.180.238 - - [28/Aug/2026:07:14:59 +1000] "GET /factory_session_joiner.php?id=34923 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [28/Aug/2026:07:15:00 +1000] "GET /heartbeat.php?sentAt=1787865300&bytes=106,144,168,212&_=1787810681827 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:07:15:01 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [28/Aug/2026:07:15:02 +1000] "GET /heartbeat.php?sentAt=1787865302&bytes=106,144,168,214&_=1787835392384 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:07:15:04 +1000] "GET /factory_session_joiner.php?id=34929 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [28/Aug/2026:07:15:04 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [28/Aug/2026:07:15:04 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [28/Aug/2026:07:15:07 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [28/Aug/2026:07:15:06 +1000] "GET /heartbeat.php?sentAt=1787865305&bytes=106,144,168,217&_=1787865011940 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:07:15:09 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /painted-hard-hats/ 3 GET /painted-guitars/ 3 GET /painted-boards/ 3 GET /custom-paint-and-airbrush-gallery/ 3 GET /category/airbrush-news/ 3 GET /about/ 2 GET /simtars-30-years-custom-hard-hat/ 2 GET /painted-engine-covers/ 2 GET /full-brimmed-custom-hard-hat/ 2 GET /custom-painted-bike-guard/ 2 GET /cfmeu-custom-hard-hats/ 2 GET / -- last 10 requests -- 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /custom-airbrushed-holden-lion-badge/ HTTP/1.1" 200 12400 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:14:59 +1000] "GET /custom-airbrush-painted-miners-hard-hat/ HTTP/1.1" 200 12691 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /patina-custom-painted-car-doors/ HTTP/1.1" 200 12667 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /ninja-turtle-hard-hat/ HTTP/1.1" 200 13298 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:14:59 +1000] "GET /custom-painted-miners-helmets-mining-safety-conference/ HTTP/1.1" 200 13560 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /custom-airbrushed-spiders-on-boot-liner/ HTTP/1.1" 200 12931 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /painted-engine-covers/ HTTP/1.1" 200 12203 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /custom-painted-bonnet-liner-graffiti/ HTTP/1.1" 200 12723 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /custom-airbrushed-reaper-engine-covers/ HTTP/1.1" 200 12691 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.84 - - [28/Aug/2026:07:15:00 +1000] "GET /custom-painted-hulk-engine-cover/ HTTP/1.1" 200 12468 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" --- last 30 samples (run-up to this incident) --- 2026-08-28 07:12:56 L1=4.20 run=5 blk=0 avail=9062 (65.8%) swpO=0 conn=3 myRSS=1584 php=5 phpRSS=353 ap=77 tcp=57 topuser=madalice 2026-08-28 07:12:56 L1=4.20 run=4 blk=0 avail=8998 (65.3%) swpO=0 conn=1 myRSS=1584 php=6 phpRSS=446 ap=77 tcp=60 topuser=evolution 2026-08-28 07:13:06 L1=3.79 run=2 blk=0 avail=9147 (66.4%) swpO=0 conn=3 myRSS=1585 php=4 phpRSS=296 ap=67 tcp=58 topuser=madalice 2026-08-28 07:13:06 L1=3.79 run=2 blk=0 avail=9089 (66.0%) swpO=0 conn=1 myRSS=1585 php=5 phpRSS=378 ap=67 tcp=58 topuser=madalice 2026-08-28 07:13:16 L1=3.29 run=2 blk=0 avail=9195 (66.7%) swpO=0 conn=3 myRSS=1585 php=5 phpRSS=329 ap=57 tcp=41 topuser=madalice 2026-08-28 07:13:16 L1=3.29 run=1 blk=0 avail=9241 (67.1%) swpO=0 conn=2 myRSS=1585 php=4 phpRSS=269 ap=57 tcp=40 topuser=madalice 2026-08-28 07:13:26 L1=2.78 run=2 blk=0 avail=9317 (67.6%) swpO=0 conn=2 myRSS=1585 php=4 phpRSS=269 ap=47 tcp=36 topuser=madalice 2026-08-28 07:13:26 L1=2.78 run=1 blk=0 avail=9317 (67.6%) swpO=0 conn=2 myRSS=1585 php=4 phpRSS=269 ap=47 tcp=36 topuser=madalice 2026-08-28 07:13:36 L1=3.25 run=2 blk=0 avail=9181 (66.6%) swpO=0 conn=2 myRSS=1585 php=5 phpRSS=402 ap=41 tcp=51 topuser=madalice 2026-08-28 07:13:36 L1=3.25 run=2 blk=0 avail=9180 (66.6%) swpO=0 conn=2 myRSS=1585 php=5 phpRSS=402 ap=41 tcp=51 topuser=madalice 2026-08-28 07:13:46 L1=3.15 run=5 blk=0 avail=8687 (63.1%) swpO=0 conn=2 myRSS=1585 php=10 phpRSS=1091 ap=33 tcp=41 topuser=madalice 2026-08-28 07:13:46 L1=3.15 run=3 blk=0 avail=8773 (63.7%) swpO=0 conn=2 myRSS=1585 php=10 phpRSS=999 ap=33 tcp=41 topuser=madalice 2026-08-28 07:13:56 L1=2.75 run=3 blk=0 avail=8621 (62.6%) swpO=0 conn=2 myRSS=1586 php=10 phpRSS=1133 ap=36 tcp=44 topuser=madalice 2026-08-28 07:13:56 L1=2.75 run=2 blk=0 avail=8738 (63.4%) swpO=0 conn=2 myRSS=1586 php=9 phpRSS=983 ap=36 tcp=45 topuser=madalice 2026-08-28 07:14:06 L1=2.32 run=1 blk=0 avail=8735 (63.4%) swpO=0 conn=2 myRSS=1586 php=9 phpRSS=1002 ap=34 tcp=43 topuser=madalice 2026-08-28 07:14:06 L1=2.32 run=2 blk=0 avail=8697 (63.1%) swpO=0 conn=2 myRSS=1586 php=10 phpRSS=1068 ap=34 tcp=42 topuser=madalice 2026-08-28 07:14:16 L1=2.52 run=17 blk=0 avail=8224 (59.7%) swpO=0 conn=12 myRSS=1586 php=19 phpRSS=1819 ap=44 tcp=94 topuser=alison 2026-08-28 07:14:16 L1=2.52 run=21 blk=0 avail=8157 (59.2%) swpO=0 conn=13 myRSS=1586 php=18 phpRSS=1839 ap=44 tcp=94 topuser=alison 2026-08-28 07:14:27 L1=4.56 run=1 blk=0 avail=9112 (66.1%) swpO=0 conn=13 myRSS=1587 php=3 phpRSS=229 ap=84 tcp=156 topuser=madalice 2026-08-28 07:14:28 L1=4.56 run=2 blk=0 avail=8768 (63.6%) swpO=0 conn=3 myRSS=1587 php=5 phpRSS=309 ap=116 tcp=131 topuser=madalice 2026-08-28 07:14:37 L1=3.93 run=1 blk=0 avail=8515 (61.8%) swpO=0 conn=13 myRSS=1587 php=5 phpRSS=390 ap=142 tcp=35 topuser=madalice 2026-08-28 07:14:38 L1=3.93 run=2 blk=0 avail=8537 (62.0%) swpO=0 conn=3 myRSS=1587 php=4 phpRSS=349 ap=140 tcp=36 topuser=madalice 2026-08-28 07:14:47 L1=3.33 run=5 blk=0 avail=8508 (61.8%) swpO=0 conn=13 myRSS=1587 php=7 phpRSS=520 ap=131 tcp=37 topuser=madalice 2026-08-28 07:14:48 L1=3.33 run=2 blk=0 avail=8498 (61.7%) swpO=0 conn=3 myRSS=1587 php=10 phpRSS=613 ap=130 tcp=40 topuser=evolution 2026-08-28 07:14:57 L1=3.19 run=18 blk=0 avail=8106 (58.8%) swpO=0 conn=13 myRSS=1587 php=17 phpRSS=1337 ap=121 tcp=46 topuser=alison 2026-08-28 07:14:58 L1=3.19 run=28 blk=0 avail=6994 (50.8%) swpO=0 conn=19 myRSS=1587 php=29 phpRSS=2655 ap=120 tcp=78 topuser=alison 2026-08-28 07:15:07 L1=8.91 run=4 blk=0 avail=8475 (61.5%) swpO=1853 conn=13 myRSS=1579 php=8 phpRSS=765 ap=111 tcp=60 topuser=madalice 2026-08-28 07:15:09 L1=8.91 run=2 blk=0 avail=8700 (63.2%) swpO=1684 conn=19 myRSS=1580 php=5 phpRSS=446 ap=110 tcp=51 topuser=madalice 2026-08-28 07:15:17 L1=7.85 run=2 blk=0 avail=8734 (63.4%) swpO=0 conn=3 myRSS=1580 php=6 phpRSS=511 ap=101 tcp=40 topuser=madalice 2026-08-28 07:15:19 L1=7.85 run=3 blk=0 avail=8761 (63.6%) swpO=0 conn=19 myRSS=1580 php=5 phpRSS=446 ap=100 tcp=41 topuser=madalice