INCIDENT 2026-08-28 09:03:54 trigger: php_rss=1569MB ================================================================== load: 2.51 2.02 1.94 6/684 1964104 ncpu:10 mem_avail: 7521MB/13777MB (54.6%) swap_used:736MB swapout:0/s blocked(D):0 running:5 iowait:0.0% steal:0.0% php: 15 procs / 1569MB heaviest user: madalice (8 procs, 1252MB) apache: 100 procs tcp_estab: 64 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2010 nobody 99 1802 madalice 8 1252 root 252 1063 mailman 20 399 evolution 10 297 netdata 7 203 wp-toolkit 3 102 cpanellogin 1 70 dovenull 6 56 mailnull 3 45 named 1 36 zabbix 1 24 dovecot 3 23 polkitd 1 20 kurri 1 8 rpc 1 5 nscd 1 5 cpanelconnecttrack 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 8 1252 evolution 6 287 root 1 29 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5650 MB Active(file): 4839 MB Inactive(file): 1120 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 540 MB CommitLimit: 10984 MB Committed_AS: 9963 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 06:45:14 11816 /usr/bin/imunify-agent-proxy 1946945 root 03:54 1260 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2058560 9.9 Ssl 06:44:43 /usr/sbin/mariadbd 529388 527476 root 178392 0.0 S 06:39:36 spamd child 508924 1 netdata 172456 1.9 Ssl 06:44:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1962325 510022 madalice 163472 28.1 S 01:52 php-fpm: pool madalice_com_au 1962793 510022 madalice 161380 28.0 S 01:20 php-fpm: pool madalice_com_au 1963292 510022 madalice 160432 19.2 S 00:47 php-fpm: pool madalice_com_au 1963285 510022 madalice 160332 20.8 S 00:48 php-fpm: pool madalice_com_au 529389 527476 root 160080 0.0 S 06:39:36 spamd child 1963273 510022 madalice 159524 16.6 S 00:48 php-fpm: pool madalice_com_au 1963777 510022 madalice 159108 21.0 S 00:17 php-fpm: pool madalice_com_au 1963778 510022 madalice 158952 14.4 S 00:17 php-fpm: pool madalice_com_au 1963787 510022 madalice 158928 15.5 S 00:16 php-fpm: pool madalice_com_au 527476 1 root 117604 0.0 Ss 06:41:15 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1890416 1353308 cpanellogin 72652 0.1 S 18:52 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1964041 1963304 evolution 69964 17.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 69352 0.0 Sl 06:44:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1964026 1963799 evolution 67360 6.5 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 938582 1 wp-toolkit 59660 0.0 Ss 04:51:46 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1964046 1963800 evolution 43616 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1964035 1963847 evolution 43524 1.5 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42340 0.0 Ss 37-06:22:35 cpsrvd (SSL) - waiting for connections 1964040 1963833 evolution 41040 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 508634 1 named 37268 0.0 Ssl 06:44:17 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 938585 1 wp-toolkit 36640 0.0 Ss 04:51:46 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 34492 0.1 Ss 59-22:54:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509266 1 root 32912 0.0 Ss 06:44:09 /usr/lib/systemd/systemd-journald 509098 1 root 32052 0.0 Ss 06:44:10 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 4180059 4180015 evolution 30884 0.0 Ss 09:03:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 510022 1 root 30616 0.0 Ss 06:44:05 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 526869 1 root 29440 0.0 Ss 06:41:38 lfd - sleeping 481558 1 root 28692 0.1 Rsl 06:46:36 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 483898 1 zabbix 25112 0.2 Ssl 06:45:26 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1942727 506832 nobody 23796 0.0 S 07:45 /usr/sbin/httpd -k start 1946286 506832 nobody 23728 0.0 S 04:36 /usr/sbin/httpd -k start 1961980 506832 nobody 23336 0.0 S 02:21 /usr/sbin/httpd -k start 1926132 506832 nobody 23112 0.0 S 10:28 /usr/sbin/httpd -k start 1924935 506832 nobody 23104 0.1 S 11:35 /usr/sbin/httpd -k start 1463 1 root 23060 0.0 Ss 59-22:54:04 tailwatchd 1961011 506832 nobody 22424 0.0 S 03:28 /usr/sbin/httpd -k start 1961018 506832 nobody 22188 0.0 S 03:27 /usr/sbin/httpd -k start 1961012 506832 nobody 22172 0.0 S 03:28 /usr/sbin/httpd -k start 508857 508814 mailman 21940 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508863 508814 mailman 21904 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508867 508814 mailman 21824 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508856 508814 mailman 21820 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 21816 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 21796 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508858 508814 mailman 21768 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 1961828 506832 nobody 21728 0.0 S 02:31 /usr/sbin/httpd -k start 508861 508814 mailman 21716 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508865 508814 mailman 21712 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 938444 1 root 21688 0.0 Ss 04:51:49 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 508860 508814 mailman 21672 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508854 508814 mailman 21648 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 1962952 506832 nobody 21624 0.1 S 01:08 /usr/sbin/httpd -k start 508866 508814 mailman 21512 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508859 508814 mailman 21504 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 1962669 506832 nobody 21480 0.0 S 01:28 /usr/sbin/httpd -k start 1962415 506832 nobody 21444 0.1 S 01:47 /usr/sbin/httpd -k start 508862 508814 mailman 21436 0.0 S 06:44:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 874282 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 874281 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT sum(quoteitems.total) as total, inventory.cat from quoteitems,inventory where quoteitems.itemid=inventory.id AND quoteitems.quoteid=? AND quoteitems.status='1' group by inventory.cat | | 874126 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 734 evolution/portal.evolutionerp.com.au-ssl_log 159 kamcool/kamcool.com.au-ssl_log 154 madalice/madalice.com.au-ssl_log 84 customc/customcentral.com.au-ssl_log 82 evolution/evolutionerp.com.au-ssl_log 31 aaa/aaadownunder.com.au-ssl_log 23 infinium/infinium.net.au-ssl_log 17 alison/alisonarts.com.au-ssl_log 10 vinesit/vinesit.com.au-ssl_log 2 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 370 203.54.180.238 209 14.1.95.251 180 158.23.184.117 101 180.181.236.49 97 103.104.165.99 79 20.104.18.15 63 20.104.104.62 52 103.104.164.114 22 147.161.213.71 22 1.145.102.184 12 124.168.5.234 9 161.153.93.152 7 118.127.40.55 7 101.166.96.210 5 20.63.81.20 --- top request paths across all vhosts (last 3 min) --- 256 POST /functions.php 150 GET /app/ajax.php 99 GET /index.php 67 POST /plugins/csvexporter/plugin.php 59 GET /heartbeat.php 41 GET /factory_session_checker.php 27 POST /app/ajax/selectFilterSingle.php 27 POST /app/ajax/selectFilter.php 24 POST /inveditsave.php 21 GET /factory_session_processed_qty.php 21 GET /factory_session_joiner.php 16 POST /clienteditsave.php 16 POST /app/ajax.php 15 POST /purchaseaddsave.php 11 POST /jobeditsave.php 9 POST /wp-login.php 8 GET / 7 GET /wp-login.php 6 POST /wp-cron.php 5 POST /portal/register --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 256 POST /functions.php 150 GET /app/ajax.php 90 GET /index.php 67 POST /plugins/csvexporter/plugin.php 27 POST /app/ajax/selectFilterSingle.php 27 POST /app/ajax/selectFilter.php 24 POST /inveditsave.php 16 POST /clienteditsave.php 16 POST /app/ajax.php 15 POST /purchaseaddsave.php 11 POST /jobeditsave.php 5 POST /invoiceaddsave.php -- last 10 requests -- 124.168.5.234 - - [28/Aug/2026:09:03:51 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13542521432 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index. 124.168.5.234 - - [28/Aug/2026:09:03:51 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D36964&call=getUserSetting&caller=ajaxSubmitLocal&seq=13984175772 HTTP/1.1" 200 113 "https: 124.168.5.234 - - [28/Aug/2026:09:03:51 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid36964&call=getUserSetting&caller=ajaxSubmitLocal&seq=11721513244 HTTP/1.1" 200 99 "https://my.evolutionerp.com. 203.54.180.238 - - [28/Aug/2026:09:03:51 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 5098 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 147.161.213.71 - - [28/Aug/2026:09:03:51 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dsiteedit%26siteid%3D2489&call=getUserSetting&caller=ajaxSubmitLocal&seq=19060139887 HTTP/1.1" 200 100 "https://my.evolutionerp.c 14.1.95.251 - - [28/Aug/2026:09:03:51 +1000] "GET /index.php?page=invedit&id=2212&string= HTTP/1.1" 200 34577 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=2212" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 14.1.95.251 - - [28/Aug/2026:09:03:51 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2212&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 124.168.5.234 - - [28/Aug/2026:09:03:51 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D36964&call=getUserSetting&caller=ajaxSubmitLocal&seq=19829606334 HTTP/1.1" 200 162 "https://my.evolutionerp. 124.168.5.234 - - [28/Aug/2026:09:03:52 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36964" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [28/Aug/2026:09:03:52 +1000] "POST /dispatchsave.php?call=fetch_inventory HTTP/1.1" 200 499 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29451&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 59 GET /heartbeat.php 41 GET /factory_session_checker.php 21 GET /factory_session_processed_qty.php 21 GET /factory_session_joiner.php 9 GET /index.php 5 POST /portal/register 3 POST /factory_functions.php -- last 10 requests -- 103.104.165.99 - - [28/Aug/2026:09:03:46 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=16333" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [28/Aug/2026:09:03:46 +1000] "GET /heartbeat.php?sentAt=1787871824&bytes=106,144,194,80&_=1787865012592 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 103.104.165.99 - - [28/Aug/2026:09:03:46 +1000] "POST /factory_functions.php HTTP/1.1" 302 20 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=16333" "Mozilla/5.0 (Linux; Android 10; K) A 103.104.165.99 - - [28/Aug/2026:09:03:47 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9259 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=16333" "Mozilla/5.0 (Linux; Andr 203.54.180.238 - - [28/Aug/2026:09:03:47 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37927&seq=2045675740905 HTTP/1.1" 200 11654 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozil 103.104.165.99 - - [28/Aug/2026:09:03:48 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, 203.54.180.238 - - [28/Aug/2026:09:03:48 +1000] "GET /index.php?page=factory_proc_queue&process=5 HTTP/1.1" 200 26216 "https://portal.evolutionerp.com.au/index.php?page=processes" "Mozilla/5.0 (Linux; Android 10; K) Appl 203.54.180.238 - - [28/Aug/2026:09:03:48 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537. 203.54.180.238 - - [28/Aug/2026:09:03:49 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [28/Aug/2026:09:03:52 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9601 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37927&seq=2045675740905" "Mozill == kamcool/kamcool.com.au-ssl_log == -- top paths -- 1 GET /wp/wp-admin/includes/ 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/ 1 GET /wp-includes/SimplePie/XML/ 1 GET /wp-includes/SimplePie/Decode/HTML/ 1 GET /wp-includes/Requests/ 1 GET /wp-includes/js/tinymce/themes/ 1 GET /wp-includes/js/tinymce/plugins/fullscreen/ 1 GET /wp-includes/images/smilies/index.php 1 GET /wp-includes/images/smilies/about.php 1 GET /wp-includes/images/media/ 1 GET /wp-includes/ID3/index.php/wp-includes/Text/ 1 GET /wp-includes/ID3/index.php -- last 10 requests -- 158.23.184.117 - - [28/Aug/2026:09:02:19 +1000] "GET /inc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:19 +1000] "GET /index.bak.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:19 +1000] "GET /info.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:19 +1000] "GET /infos.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:20 +1000] "GET /k.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:20 +1000] "GET /m.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:20 +1000] "GET /mar.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:20 +1000] "GET /mini HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:20 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:02:20 +1000] "GET /mm.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-28 09:01:33 L1=1.55 run=2 blk=0 avail=8809 (63.9%) swpO=0 conn=4 myRSS=2008 php=7 phpRSS=524 ap=43 tcp=55 topuser=madalice 2026-08-28 09:01:33 L1=1.55 run=2 blk=0 avail=8809 (63.9%) swpO=0 conn=5 myRSS=2008 php=7 phpRSS=524 ap=43 tcp=55 topuser=madalice 2026-08-28 09:01:43 L1=1.46 run=6 blk=0 avail=8829 (64.1%) swpO=0 conn=4 myRSS=2008 php=8 phpRSS=558 ap=44 tcp=51 topuser=madalice 2026-08-28 09:01:43 L1=1.46 run=5 blk=0 avail=8829 (64.1%) swpO=0 conn=5 myRSS=2008 php=8 phpRSS=558 ap=44 tcp=51 topuser=madalice 2026-08-28 09:01:53 L1=1.24 run=4 blk=0 avail=8943 (64.9%) swpO=0 conn=4 myRSS=2008 php=8 phpRSS=473 ap=39 tcp=44 topuser=evolution 2026-08-28 09:01:53 L1=1.24 run=6 blk=0 avail=8943 (64.9%) swpO=0 conn=5 myRSS=2008 php=8 phpRSS=473 ap=39 tcp=44 topuser=evolution 2026-08-28 09:02:03 L1=1.35 run=6 blk=0 avail=8804 (63.9%) swpO=0 conn=5 myRSS=2008 php=8 phpRSS=603 ap=37 tcp=53 topuser=madalice 2026-08-28 09:02:03 L1=1.35 run=4 blk=0 avail=8809 (63.9%) swpO=0 conn=7 myRSS=2008 php=8 phpRSS=600 ap=37 tcp=53 topuser=madalice 2026-08-28 09:02:13 L1=1.29 run=2 blk=0 avail=9068 (65.8%) swpO=0 conn=5 myRSS=2008 php=4 phpRSS=233 ap=38 tcp=41 topuser=madalice 2026-08-28 09:02:13 L1=1.29 run=2 blk=0 avail=9068 (65.8%) swpO=0 conn=7 myRSS=2008 php=4 phpRSS=233 ap=38 tcp=41 topuser=madalice 2026-08-28 09:02:23 L1=1.31 run=5 blk=0 avail=8932 (64.8%) swpO=0 conn=5 myRSS=2008 php=6 phpRSS=432 ap=32 tcp=39 topuser=madalice 2026-08-28 09:02:23 L1=1.31 run=6 blk=0 avail=8961 (65.0%) swpO=0 conn=7 myRSS=2008 php=6 phpRSS=436 ap=32 tcp=39 topuser=madalice 2026-08-28 09:02:33 L1=1.26 run=10 blk=0 avail=8947 (64.9%) swpO=0 conn=5 myRSS=2009 php=7 phpRSS=413 ap=37 tcp=48 topuser=madalice 2026-08-28 09:02:33 L1=1.26 run=10 blk=0 avail=8953 (65.0%) swpO=0 conn=7 myRSS=2009 php=6 phpRSS=376 ap=37 tcp=48 topuser=madalice 2026-08-28 09:02:44 L1=1.78 run=5 blk=0 avail=8758 (63.6%) swpO=0 conn=5 myRSS=2009 php=6 phpRSS=596 ap=35 tcp=45 topuser=madalice 2026-08-28 09:02:44 L1=1.78 run=6 blk=0 avail=8761 (63.6%) swpO=0 conn=7 myRSS=2009 php=6 phpRSS=602 ap=35 tcp=47 topuser=madalice 2026-08-28 09:02:54 L1=1.66 run=2 blk=0 avail=8829 (64.1%) swpO=0 conn=2 myRSS=2009 php=5 phpRSS=444 ap=43 tcp=48 topuser=madalice 2026-08-28 09:02:54 L1=1.66 run=3 blk=0 avail=8829 (64.1%) swpO=0 conn=7 myRSS=2009 php=4 phpRSS=379 ap=43 tcp=47 topuser=madalice 2026-08-28 09:03:04 L1=1.79 run=3 blk=0 avail=8852 (64.3%) swpO=0 conn=2 myRSS=2009 php=7 phpRSS=520 ap=37 tcp=46 topuser=madalice 2026-08-28 09:03:04 L1=1.79 run=4 blk=0 avail=8851 (64.2%) swpO=0 conn=3 myRSS=2009 php=7 phpRSS=520 ap=37 tcp=46 topuser=madalice 2026-08-28 09:03:14 L1=1.97 run=6 blk=0 avail=8298 (60.2%) swpO=0 conn=2 myRSS=2009 php=10 phpRSS=1078 ap=47 tcp=55 topuser=madalice 2026-08-28 09:03:14 L1=1.97 run=8 blk=0 avail=8285 (60.1%) swpO=0 conn=3 myRSS=2009 php=10 phpRSS=1091 ap=47 tcp=55 topuser=madalice 2026-08-28 09:03:24 L1=1.89 run=7 blk=0 avail=8196 (59.5%) swpO=0 conn=2 myRSS=2009 php=10 phpRSS=1115 ap=53 tcp=50 topuser=madalice 2026-08-28 09:03:24 L1=1.89 run=12 blk=0 avail=8193 (59.5%) swpO=0 conn=3 myRSS=2009 php=10 phpRSS=1118 ap=53 tcp=52 topuser=madalice 2026-08-28 09:03:34 L1=1.90 run=6 blk=0 avail=8389 (60.9%) swpO=0 conn=2 myRSS=2009 php=10 phpRSS=965 ap=49 tcp=48 topuser=madalice 2026-08-28 09:03:34 L1=1.90 run=6 blk=0 avail=8381 (60.8%) swpO=0 conn=3 myRSS=2009 php=9 phpRSS=926 ap=49 tcp=48 topuser=madalice 2026-08-28 09:03:44 L1=2.16 run=2 blk=0 avail=7632 (55.4%) swpO=0 conn=2 myRSS=2009 php=10 phpRSS=1271 ap=109 tcp=105 topuser=madalice 2026-08-28 09:03:44 L1=2.16 run=3 blk=0 avail=7631 (55.4%) swpO=0 conn=3 myRSS=2009 php=10 phpRSS=1272 ap=109 tcp=105 topuser=madalice 2026-08-28 09:03:54 L1=2.51 run=5 blk=0 avail=7521 (54.6%) swpO=0 conn=3 myRSS=2010 php=15 phpRSS=1569 ap=100 tcp=64 topuser=madalice 2026-08-28 09:03:54 L1=2.51 run=5 blk=0 avail=7520 (54.6%) swpO=0 conn=3 myRSS=2010 php=15 phpRSS=1569 ap=100 tcp=64 topuser=madalice