INCIDENT 2026-08-28 08:08:26 trigger: mysql_conn=30 ================================================================== load: 5.71 4.45 3.07 4/617 1762367 ncpu:10 mem_avail: 9082MB/13777MB (65.9%) swap_used:742MB swapout:0/s blocked(D):0 running:1 iowait:0.1% steal:0.0% php: 6 procs / 417MB heaviest user: madalice (2 procs, 292MB) apache: 39 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1801 root 251 1114 nobody 38 686 mailman 20 399 madalice 2 292 netdata 7 207 evolution 7 122 wp-toolkit 3 100 cpanellogin 1 86 mailnull 5 77 dovenull 6 56 named 1 36 kurri 3 31 zabbix 1 24 dovecot 3 23 polkitd 1 20 lowrange 1 9 rpc 1 5 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 2 292 evolution 2 69 root 1 29 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4357 MB Active(file): 3705 MB Inactive(file): 930 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 540 MB CommitLimit: 10984 MB Committed_AS: 7298 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 05:49:46 11816 /usr/bin/imunify-agent-proxy 1727322 root 08:26 1272 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1759247 root 02:35 60104 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 1845092 7.5 Ssl 05:49:15 /usr/sbin/mariadbd 508924 1 netdata 176808 1.9 Ssl 05:48:44 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529388 527476 root 176192 0.0 S 05:44:08 spamd child 1761724 510022 madalice 163888 37.2 S 00:43 php-fpm: pool madalice_com_au 529389 527476 root 160108 0.0 S 05:44:08 spamd child 1762182 510022 madalice 136076 11.2 S 00:11 php-fpm: pool madalice_com_au 527476 1 root 117656 0.0 Ss 05:45:47 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 973642 1353308 cpanellogin 88076 0.0 S 03:45:54 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 69392 0.0 Sl 05:48:41 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1759247 1 root 60104 1.3 Ssl 02:35 /opt/imunify360/venv/bin/python3 -m imav.run 938582 1 wp-toolkit 59000 0.0 Ss 03:56:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1762333 1759855 evolution 40408 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 39040 0.0 Ss 37-05:27:07 cpsrvd (SSL) - waiting for connections 508634 1 named 37268 0.0 Ssl 05:48:49 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 938585 1 wp-toolkit 35972 0.0 Ss 03:56:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 34488 0.1 Ss 59-21:58:36 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509098 1 root 32144 0.0 Ss 05:48:42 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 509266 1 root 31164 0.0 Ss 05:48:41 /usr/lib/systemd/systemd-journald 4180059 4180015 evolution 30884 0.0 Ss 08:08:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 510022 1 root 30636 0.0 Ss 05:48:37 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 526869 1 root 29372 0.0 Ss 05:46:10 lfd - sleeping 481558 1 root 28692 0.1 Ssl 05:51:08 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 483898 1 zabbix 25148 0.2 Ssl 05:49:58 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1762400 1760382 evolution 24088 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1745081 506832 nobody 23124 0.1 S 03:24 /usr/sbin/httpd -k start 1463 1 root 22944 0.0 Ss 59-21:58:36 tailwatchd 1743752 506832 nobody 22272 0.2 S 04:15 /usr/sbin/httpd -k start 508857 508814 mailman 21940 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508863 508814 mailman 21904 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508867 508814 mailman 21824 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508856 508814 mailman 21820 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 21816 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 21796 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508858 508814 mailman 21768 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 21716 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 1760382 506832 nobody 21716 0.0 S 01:26 /usr/sbin/httpd -k start 508865 508814 mailman 21712 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 938444 1 root 21688 0.0 Ss 03:56:21 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 508860 508814 mailman 21672 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508854 508814 mailman 21648 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508866 508814 mailman 21512 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508859 508814 mailman 21504 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21436 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 1760746 506832 nobody 21152 0.0 S 01:05 /usr/sbin/httpd -k start 1759812 506832 nobody 21100 0.0 S 01:58 /usr/sbin/httpd -k start 508591 1 polkitd 21044 0.0 Ssl 05:48:49 /usr/lib/polkit-1/polkitd --no-debug 1760357 506832 nobody 20960 0.0 S 01:28 /usr/sbin/httpd -k start 1759680 506832 nobody 20908 0.0 S 02:10 /usr/sbin/httpd -k start 1755690 506832 nobody 20880 0.0 S 03:16 /usr/sbin/httpd -k start 1759836 506832 nobody 20828 0.0 S 01:57 /usr/sbin/httpd -k start 1760579 506832 nobody 20812 0.0 S 01:16 /usr/sbin/httpd -k start 1759994 506832 nobody 20604 0.0 S 01:50 /usr/sbin/httpd -k start 508851 508814 mailman 20388 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508853 508814 mailman 20264 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 508852 508814 mailman 20244 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 1761566 506832 nobody 20200 0.0 S 00:52 /usr/sbin/httpd -k start 1760366 506832 nobody 20192 0.0 S 01:27 /usr/sbin/httpd -k start 508850 508814 mailman 20168 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 1760757 506832 nobody 20140 0.0 S 01:04 /usr/sbin/httpd -k start 508849 508814 mailman 19964 0.0 S 05:48:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 481124 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 310 evolution/evolutionerp.com.au-ssl_log 257 whiz/whizengineering.com.au-ssl_log 129 lowrange/lowrange.com.au-ssl_log 91 customc/customcentral.com.au-ssl_log 80 evolution/portal.evolutionerp.com.au-ssl_log 67 madalice/madalice.com.au-ssl_log 21 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 250 35.229.55.35 129 20.48.147.90 116 203.54.180.238 91 20.151.9.151 77 158.158.54.35 73 124.168.5.234 69 103.104.165.99 46 180.181.236.49 22 14.1.95.251 22 1.145.102.184 13 2600:3c02::2000:22ff:fe8a:e62 10 103.104.164.114 8 147.161.213.71 4 118.127.40.55 3 165.245.230.58 --- top request paths across all vhosts (last 3 min) --- 125 POST /functions.php 63 GET /app/ajax.php 58 GET /heartbeat.php 29 GET /index.php 16 POST /plugins/csvexporter/plugin.php 16 POST /app/ajax/selectFilter.php 13 POST /app/ajax.php 12 POST /app/ajax/selectFilterSingle.php 10 POST /quoteditsave.php 8 POST /plugins/fencecosting/plugin.php 8 GET / 6 POST /purchaseaddsave.php 4 POST /wp-cron.php 4 GET /wp-login.php 3 POST /wp-login.php 3 POST /opportunityeditsave.php 3 POST /jobeditsave.php 3 POST /inveditsave.php 3 POST /app/templates/ajax.php 3 GET /admin.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 125 POST /functions.php 63 GET /app/ajax.php 24 GET /index.php 16 POST /plugins/csvexporter/plugin.php 16 POST /app/ajax/selectFilter.php 13 POST /app/ajax.php 12 POST /app/ajax/selectFilterSingle.php 10 POST /quoteditsave.php 8 POST /plugins/fencecosting/plugin.php 6 POST /purchaseaddsave.php 3 POST /opportunityeditsave.php 3 POST /jobeditsave.php -- last 10 requests -- 14.1.95.251 - - [28/Aug/2026:08:08:23 +1000] "GET /index.php?page=invedit&id=2204&tab=purchasetab HTTP/1.1" 200 34950 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2204&tab=purchasetab" "Mozilla/5.0 (Windows 52.167.144.160 - - [28/Aug/2026:08:08:23 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D77615&call=getUserSetting&caller=ajaxSubmitLocal&seq=12972002313 HTTP/1.1" 200 101 "https://my.evolutionerp 14.1.95.251 - - [28/Aug/2026:08:08:23 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2204&tab=purchasetab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 52.167.144.139 - - [28/Aug/2026:08:08:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=77615" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gec 124.168.5.234 - - [28/Aug/2026:08:08:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=35241" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 14.1.95.251 - - [28/Aug/2026:08:08:24 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D2204%26tab%3Dpurchasetab&call=getUserSetting&caller=ajaxSubmitLocal&seq=16773394648 HTTP/1.1" 200 112 "https://my.ev 203.54.180.238 - - [28/Aug/2026:08:08:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities&date=28-08-2026&company=glenn" "Mozilla/5.0 (Windows NT 10.0 124.168.5.234 - - [28/Aug/2026:08:08:24 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 21196 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=35241" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 14.1.95.251 - - [28/Aug/2026:08:08:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2204&tab=purchasetab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [28/Aug/2026:08:08:25 +1000] "GET /index.php?page=purchaseadd&purchaseid=11272 HTTP/1.1" 200 75935 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11272" "Mozilla/5.0 (Windows NT == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 7 GET / 4 GET /wp-login.php 3 POST /wp-login.php 2 GET /@fs/proc/self/environ 1 POST /wp-cron.php 1 GET /.zsh_history 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /wp-admin/ 1 GET /web/.env 1 GET /web.config -- last 10 requests -- 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /api/v2/config HTTP/1.1" 404 119839 "-" "Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firefox/128.0; compatible; Twitterbot/1.0" 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /config/aws.yml HTTP/1.1" 404 123952 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.7808.72 Mobile Safari/537.36; compa 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /values.yaml HTTP/1.1" 404 123943 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /api/v2/settings HTTP/1.1" 404 119833 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +https://www.anthropic.com/claude-searchb 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /_debugbar/open HTTP/1.1" 404 123946 "-" "Mozilla/5.0 (compatible; facebookexternalhit/1.1; +http://www.facebook.com/externalhit_uatext.php)" 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /_ignition/health-check HTTP/1.1" 404 123954 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.2; +https://openai.com/gptbot)" 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /.svn/entries HTTP/1.1" 404 123944 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +claudebot@anthropic.com" 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /telescope/requests HTTP/1.1" 404 123950 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /.aws/credentials.bak HTTP/1.1" 404 123958 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; TelegramBot/1.0) Chrome/134.0. 35.229.55.35 - - [28/Aug/2026:08:07:45 +1000] "GET /aws/credentials HTTP/1.1" 404 123947 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 1 GET /wp-includes/pomo/up 1 GET /wp-includes/media.php 1 GET /wp-includes/js/mpvloi.php 1 GET /wp-includes/js/codemirror/hehe.php 1 GET /wp-includes/fonts/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/plugins/defaults.php 1 GET /wp-content/mu-plugins/jp.php 1 GET /wp-content/languages/wp-damin.php 1 GET /wp-content/f35.php 1 GET /wp-admin/user/rk2.php 1 GET /wp-admin/user/f35.php -- last 10 requests -- 20.48.147.90 - - [28/Aug/2026:08:07:17 +1000] "GET /index/link.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:18 +1000] "GET /index/cong.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:18 +1000] "GET /update/simple.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:19 +1000] "GET /wp-admin/css/media.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:19 +1000] "GET /images/yes.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:20 +1000] "GET /wp-admin/class.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:20 +1000] "GET /js/lock360.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:21 +1000] "GET /admin/moon.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:21 +1000] "GET /wp-admin/css/wp.php HTTP/1.1" 401 36 "-" "-" 20.48.147.90 - - [28/Aug/2026:08:07:22 +1000] "GET /admin/maint.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 08:05:55 L1=6.81 run=5 blk=0 avail=7817 (56.7%) swpO=0 conn=3 myRSS=1758 php=14 phpRSS=1719 ap=50 tcp=35 topuser=madalice 2026-08-28 08:06:04 L1=5.99 run=2 blk=0 avail=9001 (65.3%) swpO=0 conn=1 myRSS=1758 php=6 phpRSS=446 ap=41 tcp=38 topuser=madalice 2026-08-28 08:06:05 L1=5.99 run=4 blk=0 avail=9104 (66.1%) swpO=0 conn=3 myRSS=1758 php=5 phpRSS=325 ap=40 tcp=41 topuser=madalice 2026-08-28 08:06:14 L1=5.45 run=4 blk=0 avail=9255 (67.2%) swpO=0 conn=1 myRSS=1758 php=4 phpRSS=257 ap=33 tcp=44 topuser=madalice 2026-08-28 08:06:15 L1=5.45 run=2 blk=0 avail=9264 (67.2%) swpO=0 conn=3 myRSS=1758 php=5 phpRSS=289 ap=33 tcp=40 topuser=madalice 2026-08-28 08:06:24 L1=4.69 run=1 blk=0 avail=9278 (67.3%) swpO=0 conn=1 myRSS=1758 php=3 phpRSS=213 ap=34 tcp=39 topuser=madalice 2026-08-28 08:06:25 L1=4.69 run=4 blk=0 avail=9109 (66.1%) swpO=0 conn=3 myRSS=1758 php=7 phpRSS=500 ap=33 tcp=44 topuser=madalice 2026-08-28 08:06:34 L1=5.22 run=4 blk=0 avail=8970 (65.1%) swpO=0 conn=2 myRSS=1758 php=4 phpRSS=363 ap=62 tcp=48 topuser=madalice 2026-08-28 08:06:35 L1=5.22 run=2 blk=0 avail=9031 (65.6%) swpO=0 conn=3 myRSS=1758 php=5 phpRSS=329 ap=61 tcp=54 topuser=madalice 2026-08-28 08:06:44 L1=5.98 run=2 blk=0 avail=8979 (65.2%) swpO=0 conn=2 myRSS=1766 php=4 phpRSS=377 ap=58 tcp=51 topuser=customc 2026-08-28 08:06:45 L1=5.98 run=2 blk=0 avail=9045 (65.7%) swpO=0 conn=3 myRSS=1766 php=5 phpRSS=347 ap=57 tcp=51 topuser=madalice 2026-08-28 08:06:54 L1=5.44 run=3 blk=0 avail=9051 (65.7%) swpO=0 conn=2 myRSS=1766 php=5 phpRSS=394 ap=50 tcp=44 topuser=customc 2026-08-28 08:06:55 L1=5.44 run=2 blk=0 avail=9159 (66.5%) swpO=0 conn=3 myRSS=1766 php=5 phpRSS=292 ap=49 tcp=41 topuser=madalice 2026-08-28 08:07:04 L1=5.40 run=7 blk=0 avail=8508 (61.8%) swpO=0 conn=2 myRSS=1772 php=8 phpRSS=882 ap=59 tcp=46 topuser=evolution 2026-08-28 08:07:05 L1=5.40 run=2 blk=0 avail=9014 (65.4%) swpO=0 conn=3 myRSS=1772 php=5 phpRSS=381 ap=58 tcp=43 topuser=madalice 2026-08-28 08:07:14 L1=7.28 run=3 blk=0 avail=8978 (65.2%) swpO=4 conn=2 myRSS=1795 php=5 phpRSS=411 ap=56 tcp=42 topuser=madalice 2026-08-28 08:07:15 L1=7.28 run=6 blk=0 avail=8689 (63.1%) swpO=4 conn=3 myRSS=1795 php=10 phpRSS=832 ap=55 tcp=51 topuser=evolution 2026-08-28 08:07:25 L1=6.84 run=19 blk=0 avail=8161 (59.2%) swpO=0 conn=20 myRSS=1795 php=22 phpRSS=1834 ap=51 tcp=58 topuser=evolution 2026-08-28 08:07:25 L1=6.84 run=18 blk=0 avail=7783 (56.5%) swpO=0 conn=15 myRSS=1795 php=18 phpRSS=2056 ap=51 tcp=60 topuser=evolution 2026-08-28 08:07:36 L1=7.49 run=9 blk=0 avail=8644 (62.7%) swpO=0 conn=15 myRSS=1795 php=7 phpRSS=743 ap=77 tcp=87 topuser=evolution 2026-08-28 08:07:37 L1=7.85 run=10 blk=0 avail=8787 (63.8%) swpO=0 conn=7 myRSS=1795 php=11 phpRSS=615 ap=77 tcp=66 topuser=evolution 2026-08-28 08:07:46 L1=7.30 run=34 blk=0 avail=6980 (50.7%) swpO=0 conn=30 myRSS=1801 php=32 phpRSS=3135 ap=69 tcp=68 topuser=evolution 2026-08-28 08:07:47 L1=8.96 run=31 blk=0 avail=6289 (45.6%) swpO=0 conn=24 myRSS=1801 php=28 phpRSS=3536 ap=68 tcp=63 topuser=evolution 2026-08-28 08:07:56 L1=7.66 run=2 blk=0 avail=9086 (65.9%) swpO=0 conn=30 myRSS=1801 php=4 phpRSS=238 ap=59 tcp=43 topuser=madalice 2026-08-28 08:07:57 L1=7.66 run=3 blk=0 avail=8990 (65.3%) swpO=0 conn=24 myRSS=1801 php=4 phpRSS=349 ap=58 tcp=39 topuser=madalice 2026-08-28 08:08:06 L1=7.08 run=2 blk=0 avail=9024 (65.5%) swpO=0 conn=30 myRSS=1801 php=5 phpRSS=396 ap=49 tcp=43 topuser=madalice 2026-08-28 08:08:07 L1=7.08 run=5 blk=0 avail=9083 (65.9%) swpO=0 conn=24 myRSS=1801 php=5 phpRSS=350 ap=48 tcp=42 topuser=madalice 2026-08-28 08:08:16 L1=6.38 run=4 blk=0 avail=9066 (65.8%) swpO=0 conn=30 myRSS=1801 php=6 phpRSS=429 ap=39 tcp=48 topuser=madalice 2026-08-28 08:08:17 L1=6.38 run=3 blk=0 avail=8942 (64.9%) swpO=0 conn=24 myRSS=1801 php=5 phpRSS=551 ap=38 tcp=47 topuser=madalice 2026-08-28 08:08:26 L1=5.71 run=1 blk=0 avail=9082 (65.9%) swpO=0 conn=30 myRSS=1801 php=6 phpRSS=417 ap=39 tcp=62 topuser=madalice