INCIDENT 2026-08-28 08:07:25 trigger: php_rss=1834MB mysql_conn=20 ================================================================== load: 6.84 4.06 2.84 23/649 1760827 ncpu:10 mem_avail: 8161MB/13777MB (59.2%) swap_used:742MB swapout:0/s blocked(D):0 running:19 iowait:0.2% steal:0.0% php: 22 procs / 1834MB heaviest user: evolution (19 procs, 1509MB) apache: 51 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1795 evolution 23 1765 root 254 1179 nobody 50 885 mailman 20 399 netdata 7 205 customc 1 166 madalice 1 156 wp-toolkit 3 100 cpanellogin 1 86 mailnull 5 78 dovenull 6 56 named 1 36 kurri 3 31 zabbix 1 26 dovecot 3 23 polkitd 1 20 candyfabcom 1 14 lowrange 1 9 rpc 1 5 --- php workers by user --- USER PROCS RSS_MB evolution 19 1790 customc 1 174 madalice 1 156 root 1 29 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4355 MB Active(file): 3681 MB Inactive(file): 944 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 540 MB CommitLimit: 10984 MB Committed_AS: 9095 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 05:48:45 11816 /usr/bin/imunify-agent-proxy 1727322 root 07:25 1272 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1759247 root 01:34 60104 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 1838596 7.4 Ssl 05:48:14 /usr/sbin/mariadbd 529388 527476 root 176192 0.0 S 05:43:07 spamd child 508924 1 netdata 175020 1.9 Ssl 05:47:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1760044 510022 madalice 160380 8.7 S 00:44 php-fpm: pool madalice_com_au 529389 527476 root 160108 0.0 S 05:43:07 spamd child 1760768 1759804 evolution 158752 35.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760767 1760377 evolution 149964 35.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760766 1758689 evolution 149468 31.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760774 1760357 evolution 145480 72.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760775 1759836 evolution 145428 60.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760783 1759852 evolution 130300 54.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 527476 1 root 117656 0.0 Ss 05:44:46 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1760772 1758690 evolution 117448 40.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760784 1754595 evolution 107244 47.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760771 1759812 evolution 99484 40.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760791 1743602 evolution 97024 31.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760787 1744224 evolution 88392 26.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 973642 1353308 cpanellogin 88076 0.0 S 03:44:53 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1760788 1751089 evolution 86428 25.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760776 1760380 evolution 86372 27.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760789 1759994 evolution 86220 33.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760796 1759855 evolution 83228 26.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1760792 1752001 evolution 79820 21.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 509236 509098 root 69392 0.0 Sl 05:47:40 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1760770 1758663 evolution 67912 21.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1760807 1755675 evolution 66264 12.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1759247 1 root 60104 2.2 Ssl 01:34 /opt/imunify360/venv/bin/python3 -m imav.run 938582 1 wp-toolkit 59000 0.0 Ss 03:55:17 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 39040 0.0 Ss 37-05:26:06 cpsrvd (SSL) - waiting for connections 508634 1 named 37268 0.0 Ssl 05:47:48 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1760802 1469 root 36088 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 35972 0.0 Ss 03:55:17 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 34488 0.1 Ss 59-21:57:35 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1760856 1760579 evolution 33484 2.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509098 1 root 32144 0.0 Ss 05:47:41 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 509266 1 root 31164 0.0 Ss 05:47:40 /usr/lib/systemd/systemd-journald 4180059 4180015 evolution 30884 0.0 Ss 08:07:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 510022 1 root 30636 0.0 Ss 05:47:36 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 526869 1 root 29368 0.0 Ss 05:45:09 lfd - sleeping 481558 1 root 28692 0.1 Ssl 05:50:07 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 483898 1 zabbix 26756 0.2 Ssl 05:48:57 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 22940 0.0 Ss 59-21:57:35 tailwatchd 1743752 506832 nobody 22220 0.2 S 03:14 /usr/sbin/httpd -k start 508857 508814 mailman 21940 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 1743764 506832 nobody 21908 0.0 S 03:13 /usr/sbin/httpd -k start 508863 508814 mailman 21904 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508867 508814 mailman 21824 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508856 508814 mailman 21820 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 21816 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 21796 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508858 508814 mailman 21768 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 21716 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508865 508814 mailman 21712 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 938444 1 root 21688 0.0 Ss 03:55:20 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 508860 508814 mailman 21672 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508854 508814 mailman 21648 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508866 508814 mailman 21512 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508859 508814 mailman 21504 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21436 0.0 S 05:47:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 1752001 506832 nobody 21196 0.0 S 02:18 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+----------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+----------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 477592 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 477590 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 477588 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT * from sessions WHERE staffid='164' and status='1' | | 477565 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | System lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_oauth_client_id' LIMIT 1 | | 477559 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | System lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra_sites_batch_process_started' LIMIT 1 | | 477552 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | System lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jb_transient_premium_features' LIMIT 1 | +--------+----------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 336 evolution/my.evolutionerp.com.au-ssl_log 291 whiz/whizengineering.com.au-ssl_log 129 madalice/madalice.com.au-ssl_log 73 evolution/portal.evolutionerp.com.au-ssl_log 54 customc/customcentral.com.au-ssl_log 42 infinium/infinium.net.au-ssl_log 13 aaa/aaadownunder.com.au-ssl_log 11 corpkicks/corporatekicks.com.au-ssl_log 5 infinium/infinium.net.au 3 corpkicks/2025.corporatekicks.com.au-ssl_log 2 nrg/nrgservices.net.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 329 35.229.55.35 129 20.48.147.90 105 203.54.180.238 83 103.104.165.99 54 124.168.5.234 38 158.158.54.35 36 20.63.81.20 36 1.145.102.184 33 3.84.14.142 32 180.181.236.49 20 14.1.95.251 12 20.104.81.161 12 118.127.40.55 8 147.161.213.71 8 103.104.164.114 --- top request paths across all vhosts (last 3 min) --- 117 POST /functions.php 57 GET /app/ajax.php 51 GET /heartbeat.php 25 GET /index.php 17 POST /plugins/csvexporter/plugin.php 14 POST /app/ajax/selectFilter.php 13 POST /app/ajax.php 11 POST /app/ajax/selectFilterSingle.php 11 GET / 9 POST /wp-cron.php 9 GET /wp-login.php 7 POST /plugins/fencecosting/plugin.php 6 POST /quoteditsave.php 5 POST /purchaseaddsave.php 5 POST /jobeditsave.php 4 POST /wp-login.php 4 GET /login 3 POST /inveditsave.php 3 POST /clienteditsave.php 3 POST / --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 7 GET / 6 GET /wp-login.php 3 POST /wp-login.php 2 GET /.zsh_history 2 GET /wp-config.php.old 2 GET /wp-config.php.bak 2 GET /wp-config.php 2 GET /wp-admin/ 2 GET /web/.env 2 GET /v2/.env 2 GET /v1/graphql 2 GET /v1/.env -- last 10 requests -- 35.229.55.35 - - [28/Aug/2026:08:07:21 +1000] "GET /sendgrid.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity 35.229.55.35 - - [28/Aug/2026:08:07:22 +1000] "GET /client/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; meta-externalagent/1.1; +https://dev 35.229.55.35 - - [28/Aug/2026:08:07:21 +1000] "GET /config/master.key HTTP/1.1" 404 123949 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 35.229.55.35 - - [28/Aug/2026:08:07:21 +1000] "GET /.bash_profile HTTP/1.1" 404 123951 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.7113.247 Safari/537.36; compatible; 35.229.55.35 - - [28/Aug/2026:08:07:21 +1000] "GET /.flaskenv HTTP/1.1" 404 123941 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" 35.229.55.35 - - [28/Aug/2026:08:07:21 +1000] "GET /.github/workflows/deploy.yml HTTP/1.1" 404 119850 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Applebot/0.1; 35.229.55.35 - - [28/Aug/2026:08:07:21 +1000] "GET /.gitlab-ci.yml HTTP/1.1" 404 123946 "-" "Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)" 165.245.230.58 - - [28/Aug/2026:08:07:24 +1000] "POST /wp-login.php HTTP/1.1" 401 3456 "-" "Mozilla/5.0" 165.245.230.58 - - [28/Aug/2026:08:07:24 +1000] "POST /wp-login.php HTTP/1.1" 401 3456 "-" "Mozilla/5.0" 165.245.230.58 - - [28/Aug/2026:08:07:24 +1000] "POST /wp-login.php HTTP/1.1" 401 3456 "-" "Mozilla/5.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 117 POST /functions.php 57 GET /app/ajax.php 23 GET /index.php 17 POST /plugins/csvexporter/plugin.php 14 POST /app/ajax/selectFilter.php 13 POST /app/ajax.php 11 POST /app/ajax/selectFilterSingle.php 7 POST /plugins/fencecosting/plugin.php 6 POST /quoteditsave.php 5 POST /purchaseaddsave.php 5 POST /jobeditsave.php 3 POST /inveditsave.php -- last 10 requests -- 203.54.180.238 - - [28/Aug/2026:08:07:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=clientlist" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.165.99 - - [28/Aug/2026:08:07:18 +1000] "GET /index.php?page=invedit&id=8030 HTTP/1.1" 200 37081 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11272" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [28/Aug/2026:08:07:18 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=8030&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [28/Aug/2026:08:07:18 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D8030%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=10585644528 HTTP/1.1" 200 109 "https://my. 103.104.165.99 - - [28/Aug/2026:08:07:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=8030&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [28/Aug/2026:08:07:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities&date=28-08-2026&company=glenn" "Mozilla/5.0 (Windows NT 10.0 203.54.180.238 - - [28/Aug/2026:08:07:22 +1000] "POST /clienteditsave.php?call=getClients HTTP/1.1" 200 376 "https://my.evolutionerp.com.au/index.php?page=clientlist" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 180.181.236.49 - - [28/Aug/2026:08:07:22 +1000] "GET /index.php?page=purchasereg HTTP/1.1" 200 13551 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1302" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [28/Aug/2026:08:07:23 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 974 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportunityid=8138" "Mozilla/5.0 (Windows NT 10.0; Win6 180.181.236.49 - - [28/Aug/2026:08:07:23 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchasereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=12096560744 HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.ph == whiz/whizengineering.com.au-ssl_log == -- top paths -- 1 GET /wp-includes/pomo/up 1 GET /wp-includes/media.php 1 GET /wp-includes/js/mpvloi.php 1 GET /wp-includes/js/codemirror/hehe.php 1 GET /wp-includes/fonts/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/plugins/defaults.php 1 GET /wp-content/mu-plugins/jp.php 1 GET /wp-content/languages/wp-damin.php 1 GET /wp-content/f35.php 1 GET /wp-admin/user/rk2.php 1 GET /wp-admin/user/f35.php -- last 10 requests -- 20.48.147.90 - - [28/Aug/2026:08:07:17 +1000] "GET /index/link.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:18 +1000] "GET /index/cong.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:18 +1000] "GET /update/simple.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:19 +1000] "GET /wp-admin/css/media.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:19 +1000] "GET /images/yes.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:20 +1000] "GET /wp-admin/class.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:20 +1000] "GET /js/lock360.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:21 +1000] "GET /admin/moon.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:21 +1000] "GET /wp-admin/css/wp.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:22 +1000] "GET /admin/maint.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 08:05:03 L1=3.33 run=3 blk=0 avail=9185 (66.7%) swpO=0 conn=2 myRSS=1779 php=4 phpRSS=289 ap=40 tcp=64 topuser=madalice 2026-08-28 08:05:04 L1=3.33 run=4 blk=0 avail=8991 (65.3%) swpO=0 conn=1 myRSS=1779 php=4 phpRSS=505 ap=40 tcp=41 topuser=madalice 2026-08-28 08:05:13 L1=3.73 run=3 blk=0 avail=8045 (58.4%) swpO=0 conn=4 myRSS=1780 php=15 phpRSS=1506 ap=68 tcp=64 topuser=madalice 2026-08-28 08:05:14 L1=3.73 run=28 blk=0 avail=6486 (47.1%) swpO=0 conn=23 myRSS=1803 php=38 phpRSS=3771 ap=68 tcp=95 topuser=evolution 2026-08-28 08:05:24 L1=5.48 run=15 blk=0 avail=7375 (53.5%) swpO=1813 conn=8 myRSS=1768 php=12 phpRSS=2029 ap=67 tcp=54 topuser=madalice 2026-08-28 08:05:25 L1=5.48 run=3 blk=0 avail=7852 (57.0%) swpO=1813 conn=3 myRSS=1768 php=12 phpRSS=1614 ap=66 tcp=49 topuser=madalice 2026-08-28 08:05:34 L1=7.45 run=3 blk=0 avail=7677 (55.7%) swpO=1192 conn=4 myRSS=1755 php=15 phpRSS=1902 ap=69 tcp=49 topuser=madalice 2026-08-28 08:05:35 L1=7.45 run=5 blk=0 avail=7803 (56.6%) swpO=1192 conn=4 myRSS=1755 php=13 phpRSS=1713 ap=68 tcp=53 topuser=madalice 2026-08-28 08:05:44 L1=6.53 run=3 blk=0 avail=7771 (56.4%) swpO=0 conn=14 myRSS=1755 php=26 phpRSS=2142 ap=60 tcp=76 topuser=madalice 2026-08-28 08:05:45 L1=6.53 run=26 blk=0 avail=6410 (46.5%) swpO=0 conn=22 myRSS=1756 php=34 phpRSS=3786 ap=59 tcp=57 topuser=evolution 2026-08-28 08:05:54 L1=6.81 run=1 blk=0 avail=7882 (57.2%) swpO=0 conn=1 myRSS=1758 php=12 phpRSS=1613 ap=51 tcp=35 topuser=madalice 2026-08-28 08:05:55 L1=6.81 run=5 blk=0 avail=7817 (56.7%) swpO=0 conn=3 myRSS=1758 php=14 phpRSS=1719 ap=50 tcp=35 topuser=madalice 2026-08-28 08:06:04 L1=5.99 run=2 blk=0 avail=9001 (65.3%) swpO=0 conn=1 myRSS=1758 php=6 phpRSS=446 ap=41 tcp=38 topuser=madalice 2026-08-28 08:06:05 L1=5.99 run=4 blk=0 avail=9104 (66.1%) swpO=0 conn=3 myRSS=1758 php=5 phpRSS=325 ap=40 tcp=41 topuser=madalice 2026-08-28 08:06:14 L1=5.45 run=4 blk=0 avail=9255 (67.2%) swpO=0 conn=1 myRSS=1758 php=4 phpRSS=257 ap=33 tcp=44 topuser=madalice 2026-08-28 08:06:15 L1=5.45 run=2 blk=0 avail=9264 (67.2%) swpO=0 conn=3 myRSS=1758 php=5 phpRSS=289 ap=33 tcp=40 topuser=madalice 2026-08-28 08:06:24 L1=4.69 run=1 blk=0 avail=9278 (67.3%) swpO=0 conn=1 myRSS=1758 php=3 phpRSS=213 ap=34 tcp=39 topuser=madalice 2026-08-28 08:06:25 L1=4.69 run=4 blk=0 avail=9109 (66.1%) swpO=0 conn=3 myRSS=1758 php=7 phpRSS=500 ap=33 tcp=44 topuser=madalice 2026-08-28 08:06:34 L1=5.22 run=4 blk=0 avail=8970 (65.1%) swpO=0 conn=2 myRSS=1758 php=4 phpRSS=363 ap=62 tcp=48 topuser=madalice 2026-08-28 08:06:35 L1=5.22 run=2 blk=0 avail=9031 (65.6%) swpO=0 conn=3 myRSS=1758 php=5 phpRSS=329 ap=61 tcp=54 topuser=madalice 2026-08-28 08:06:44 L1=5.98 run=2 blk=0 avail=8979 (65.2%) swpO=0 conn=2 myRSS=1766 php=4 phpRSS=377 ap=58 tcp=51 topuser=customc 2026-08-28 08:06:45 L1=5.98 run=2 blk=0 avail=9045 (65.7%) swpO=0 conn=3 myRSS=1766 php=5 phpRSS=347 ap=57 tcp=51 topuser=madalice 2026-08-28 08:06:54 L1=5.44 run=3 blk=0 avail=9051 (65.7%) swpO=0 conn=2 myRSS=1766 php=5 phpRSS=394 ap=50 tcp=44 topuser=customc 2026-08-28 08:06:55 L1=5.44 run=2 blk=0 avail=9159 (66.5%) swpO=0 conn=3 myRSS=1766 php=5 phpRSS=292 ap=49 tcp=41 topuser=madalice 2026-08-28 08:07:04 L1=5.40 run=7 blk=0 avail=8508 (61.8%) swpO=0 conn=2 myRSS=1772 php=8 phpRSS=882 ap=59 tcp=46 topuser=evolution 2026-08-28 08:07:05 L1=5.40 run=2 blk=0 avail=9014 (65.4%) swpO=0 conn=3 myRSS=1772 php=5 phpRSS=381 ap=58 tcp=43 topuser=madalice 2026-08-28 08:07:14 L1=7.28 run=3 blk=0 avail=8978 (65.2%) swpO=4 conn=2 myRSS=1795 php=5 phpRSS=411 ap=56 tcp=42 topuser=madalice 2026-08-28 08:07:15 L1=7.28 run=6 blk=0 avail=8689 (63.1%) swpO=4 conn=3 myRSS=1795 php=10 phpRSS=832 ap=55 tcp=51 topuser=evolution 2026-08-28 08:07:25 L1=6.84 run=19 blk=0 avail=8161 (59.2%) swpO=0 conn=20 myRSS=1795 php=22 phpRSS=1834 ap=51 tcp=58 topuser=evolution 2026-08-28 08:07:25 L1=6.84 run=18 blk=0 avail=7783 (56.5%) swpO=0 conn=15 myRSS=1795 php=18 phpRSS=2056 ap=51 tcp=60 topuser=evolution