INCIDENT 2026-08-28 09:07:36 trigger: php_rss=1533MB ================================================================== load: 3.72 2.59 2.17 5/638 1982304 ncpu:10 mem_avail: 7860MB/13777MB (57.1%) swap_used:736MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 13 procs / 1533MB heaviest user: madalice (8 procs, 1319MB) apache: 53 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2013 madalice 8 1332 root 255 1155 nobody 52 965 mailman 20 399 netdata 7 202 evolution 7 121 wp-toolkit 3 102 cpanellogin 1 73 dovenull 6 56 mailnull 3 45 named 1 36 candyfabcom 2 28 zabbix 1 25 dovecot 3 23 polkitd 1 20 kurri 1 8 rpc 1 5 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1333 evolution 4 120 root 1 29 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5651 MB Active(file): 4851 MB Inactive(file): 1137 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 540 MB CommitLimit: 10984 MB Committed_AS: 8756 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 06:48:56 11816 /usr/bin/imunify-agent-proxy 1946945 root 07:36 1260 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2062128 10.2 Ssl 06:48:25 /usr/sbin/mariadbd 1963787 510022 madalice 244856 11.5 R 03:58 php-fpm: pool madalice_com_au 529388 527476 root 178352 0.0 S 06:43:18 spamd child 508924 1 netdata 172068 1.9 Ssl 06:47:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1963285 510022 madalice 163648 12.5 S 04:30 php-fpm: pool madalice_com_au 1962325 510022 madalice 163596 16.4 S 05:34 php-fpm: pool madalice_com_au 1963273 510022 madalice 163200 11.7 S 04:30 php-fpm: pool madalice_com_au 1962793 510022 madalice 161136 15.4 S 05:02 php-fpm: pool madalice_com_au 1963292 510022 madalice 160492 12.5 S 04:29 php-fpm: pool madalice_com_au 529389 527476 root 160036 0.0 S 06:43:18 spamd child 1963778 510022 madalice 159748 11.4 S 03:59 php-fpm: pool madalice_com_au 1963777 510022 madalice 159428 11.3 S 03:59 php-fpm: pool madalice_com_au 527476 1 root 117544 0.0 Ss 06:44:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1890416 1353308 cpanellogin 75248 0.0 S 22:34 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1982298 1982234 evolution 73516 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 69328 0.0 Sl 06:47:51 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 938582 1 wp-toolkit 59652 0.0 Ss 04:55:28 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1982313 1980771 evolution 53004 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42340 0.0 Ss 37-06:26:17 cpsrvd (SSL) - waiting for connections 1982248 1982231 evolution 41760 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 508634 1 named 37268 0.0 Ssl 06:47:59 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 938585 1 wp-toolkit 36632 0.0 Ss 04:55:28 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1982301 1469 root 36372 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 34492 0.1 Ss 59-22:57:46 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509266 1 root 33200 0.0 Ss 06:47:51 /usr/lib/systemd/systemd-journald 509098 1 root 32052 0.0 Ss 06:47:52 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 4180059 4180015 evolution 30868 0.0 Ss 09:07:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 510022 1 root 30600 0.0 Ss 06:47:47 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 526869 1 root 29448 0.0 Ss 06:45:20 lfd - sleeping 481558 1 root 28692 0.1 Ssl 06:50:18 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 483898 1 zabbix 25612 0.2 Ssl 06:49:08 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1946286 506832 nobody 23908 0.0 S 08:18 /usr/sbin/httpd -k start 1463 1 root 22932 0.0 Ss 59-22:57:46 tailwatchd 1962680 506832 nobody 22924 0.0 S 05:09 /usr/sbin/httpd -k start 1963800 506832 nobody 22300 0.1 S 03:58 /usr/sbin/httpd -k start 1963783 506832 nobody 22268 0.1 S 03:59 /usr/sbin/httpd -k start 1963855 506832 nobody 22268 0.0 S 03:57 /usr/sbin/httpd -k start 1961987 506832 nobody 22208 0.0 S 06:02 /usr/sbin/httpd -k start 1980140 506832 nobody 21964 0.0 S 01:47 /usr/sbin/httpd -k start 508857 508814 mailman 21940 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508863 508814 mailman 21904 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508867 508814 mailman 21824 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508856 508814 mailman 21820 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 21816 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 1963804 506832 nobody 21800 0.1 S 03:58 /usr/sbin/httpd -k start 508864 508814 mailman 21796 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508858 508814 mailman 21768 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 1979660 506832 nobody 21752 0.1 S 02:22 /usr/sbin/httpd -k start 508861 508814 mailman 21716 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508865 508814 mailman 21712 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 938444 1 root 21680 0.0 Ss 04:55:31 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 508860 508814 mailman 21672 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508854 508814 mailman 21648 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 1965165 506832 nobody 21528 0.0 S 02:47 /usr/sbin/httpd -k start 508866 508814 mailman 21512 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508859 508814 mailman 21504 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 1963847 506832 nobody 21476 0.0 S 03:57 /usr/sbin/httpd -k start 508862 508814 mailman 21436 0.0 S 06:47:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 1980139 506832 nobody 21356 0.1 S 01:47 /usr/sbin/httpd -k start 1963774 506832 nobody 21280 0.0 S 04:00 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 902399 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 644 candyfabcom/candyfab.com.au-ssl_log 325 coscom/swms.coscom.com.au-ssl_log 154 evolution/portal.evolutionerp.com.au-ssl_log 120 madalice/madalice.com.au-ssl_log 120 evolution/evolutionerp.com.au-ssl_log 93 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 290 52.139.37.240 241 203.54.180.238 154 158.23.184.117 148 14.1.95.251 112 103.104.165.99 105 101.166.96.210 95 20.104.104.62 80 180.181.236.49 74 20.48.160.90 35 20.48.179.39 26 103.104.164.114 23 147.161.213.71 20 40.83.93.50 17 20.151.129.194 8 54.209.60.63 --- top request paths across all vhosts (last 3 min) --- 228 POST /functions.php 117 GET /app/ajax.php 76 GET /index.php 47 GET /heartbeat.php 42 POST /plugins/csvexporter/plugin.php 30 GET /factory_session_checker.php 27 POST /app/ajax/selectFilterSingle.php 23 POST /app/ajax/selectFilter.php 22 POST /quoteditsave.php 17 POST /app/ajax.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 14 POST /itemModify.php 12 POST /plugins/fencecosting/plugin.php 12 POST /invaddsave.php 11 POST /inveditsave.php 11 POST /clienteditsave.php 8 POST /purchaseaddsave.php 7 POST /billaddsave.php 6 GET /goods.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 228 POST /functions.php 117 GET /app/ajax.php 69 GET /index.php 42 POST /plugins/csvexporter/plugin.php 27 POST /app/ajax/selectFilterSingle.php 23 POST /app/ajax/selectFilter.php 22 POST /quoteditsave.php 17 POST /app/ajax.php 14 POST /itemModify.php 12 POST /plugins/fencecosting/plugin.php 12 POST /invaddsave.php 11 POST /inveditsave.php -- last 10 requests -- 203.54.180.238 - - [28/Aug/2026:09:07:33 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=19933974365 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [28/Aug/2026:09:07:33 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D29561&call=getUserSetting&caller=ajaxSubmitLocal&seq=16985387743 HTTP/1.1" 200 112 "https://my. 203.54.180.238 - - [28/Aug/2026:09:07:33 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=11252223381 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [28/Aug/2026:09:07:34 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D29561&call=getUserSetting&caller=ajaxSubmitLocal&seq=15517573738 HTTP/1.1" 200 98 "https://my.evolutionerp.com.au 103.104.164.114 - - [28/Aug/2026:09:07:34 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=1795" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 203.54.180.238 - - [28/Aug/2026:09:07:34 +1000] "POST /tasksave.php?id=11315&call=getTask HTTP/1.1" 200 349 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29561" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [28/Aug/2026:09:07:34 +1000] "GET /index.php?page=invoicereg HTTP/1.1" 200 14372 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 203.54.180.238 - - [28/Aug/2026:09:07:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 3269 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29561" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [28/Aug/2026:09:07:35 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 24034 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29561" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 1.145.102.184 - - [28/Aug/2026:09:07:36 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36672" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 3 GET /wp-cron.php 2 GET /wp-login.php 2 GET /simple.php 2 GET /radio.php 2 GET /mar.php 2 GET /lock360.php 2 GET /k.php 2 GET /goods.php 2 GET /function.php 2 GET /404.php 2 GET /403.php 2 GET /1.php -- last 10 requests -- 52.139.37.240 - - [28/Aug/2026:09:07:21 +1000] "GET /wp-admin/images/chosen.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:09:07:21 +1000] "GET /wp-admin/install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:09:07:21 +1000] "GET /wp-includes/js/tinymce/skins/lightgray/img/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 52.139.37.240 - - [28/Aug/2026:09:07:21 +1000] "GET /cgi-bin/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:09:07:21 +1000] "GET /wp-admin/css/colors/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:09:07:22 +1000] "GET /.well-known/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [28/Aug/2026:09:07:22 +1000] "GET /wp-admin/js/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:09:07:22 +1000] "GET /comfunctions.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:09:07:22 +1000] "GET /images/class-config.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:09:07:22 +1000] "GET /wp-includes/widgets/include.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 == coscom/swms.coscom.com.au-ssl_log == -- top paths -- 1 GET /wp/wp-admin/includes/ 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/ 1 GET /wp-includes/SimplePie/XML/ 1 GET /wp-includes/SimplePie/Decode/HTML/ 1 GET /wp-includes/Requests/ 1 GET /wp-includes/js/tinymce/themes/ 1 GET /wp-includes/js/tinymce/plugins/fullscreen/ 1 GET /wp-includes/images/smilies/index.php 1 GET /wp-includes/images/smilies/about.php 1 GET /wp-includes/images/media/ 1 GET /wp-includes/ID3/index.php/wp-includes/Text/ 1 GET /wp-includes/ID3/index.php -- last 10 requests -- 158.23.184.117 - - [28/Aug/2026:09:06:47 +1000] "GET /inc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:47 +1000] "GET /index.bak.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:47 +1000] "GET /info.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:48 +1000] "GET /infos.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:48 +1000] "GET /k.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:48 +1000] "GET /m.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:48 +1000] "GET /mar.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:48 +1000] "GET /mini HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:48 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:09:06:49 +1000] "GET /mm.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-28 09:05:15 L1=2.50 run=2 blk=0 avail=7987 (58.0%) swpO=0 conn=2 myRSS=2010 php=11 phpRSS=1431 ap=39 tcp=46 topuser=madalice 2026-08-28 09:05:16 L1=2.50 run=5 blk=0 avail=8043 (58.4%) swpO=0 conn=4 myRSS=2011 php=12 phpRSS=1415 ap=39 tcp=43 topuser=madalice 2026-08-28 09:05:25 L1=2.50 run=3 blk=0 avail=8101 (58.8%) swpO=0 conn=2 myRSS=2012 php=10 phpRSS=1319 ap=36 tcp=37 topuser=madalice 2026-08-28 09:05:26 L1=2.50 run=3 blk=0 avail=8019 (58.2%) swpO=0 conn=4 myRSS=2012 php=11 phpRSS=1426 ap=35 tcp=43 topuser=madalice 2026-08-28 09:05:35 L1=2.44 run=3 blk=0 avail=8028 (58.3%) swpO=0 conn=2 myRSS=2012 php=11 phpRSS=1405 ap=38 tcp=47 topuser=madalice 2026-08-28 09:05:36 L1=2.44 run=1 blk=0 avail=8081 (58.7%) swpO=0 conn=4 myRSS=2012 php=10 phpRSS=1313 ap=38 tcp=48 topuser=madalice 2026-08-28 09:05:45 L1=2.36 run=4 blk=0 avail=7873 (57.1%) swpO=0 conn=3 myRSS=2012 php=11 phpRSS=1567 ap=37 tcp=40 topuser=madalice 2026-08-28 09:05:46 L1=2.36 run=4 blk=0 avail=8096 (58.8%) swpO=0 conn=4 myRSS=2012 php=11 phpRSS=1355 ap=37 tcp=41 topuser=madalice 2026-08-28 09:05:55 L1=2.29 run=5 blk=0 avail=8008 (58.1%) swpO=0 conn=3 myRSS=2013 php=12 phpRSS=1449 ap=36 tcp=52 topuser=madalice 2026-08-28 09:05:56 L1=2.29 run=2 blk=0 avail=7971 (57.9%) swpO=0 conn=4 myRSS=2013 php=12 phpRSS=1483 ap=37 tcp=55 topuser=madalice 2026-08-28 09:06:05 L1=2.25 run=3 blk=0 avail=7956 (57.7%) swpO=0 conn=4 myRSS=2013 php=11 phpRSS=1360 ap=52 tcp=56 topuser=madalice 2026-08-28 09:06:06 L1=2.25 run=1 blk=0 avail=7966 (57.8%) swpO=0 conn=4 myRSS=2013 php=11 phpRSS=1352 ap=52 tcp=52 topuser=madalice 2026-08-28 09:06:15 L1=2.52 run=2 blk=0 avail=7970 (57.9%) swpO=0 conn=4 myRSS=2013 php=10 phpRSS=1367 ap=48 tcp=48 topuser=madalice 2026-08-28 09:06:16 L1=2.52 run=3 blk=0 avail=8016 (58.2%) swpO=0 conn=4 myRSS=2013 php=12 phpRSS=1387 ap=47 tcp=48 topuser=madalice 2026-08-28 09:06:25 L1=2.43 run=3 blk=0 avail=8006 (58.1%) swpO=0 conn=4 myRSS=2013 php=10 phpRSS=1315 ap=47 tcp=44 topuser=madalice 2026-08-28 09:06:26 L1=2.43 run=2 blk=0 avail=7967 (57.8%) swpO=0 conn=4 myRSS=2013 php=12 phpRSS=1417 ap=47 tcp=45 topuser=madalice 2026-08-28 09:06:35 L1=2.59 run=5 blk=0 avail=7835 (56.9%) swpO=0 conn=4 myRSS=2013 php=12 phpRSS=1568 ap=43 tcp=55 topuser=madalice 2026-08-28 09:06:36 L1=2.59 run=7 blk=0 avail=7885 (57.2%) swpO=0 conn=5 myRSS=2013 php=14 phpRSS=1548 ap=47 tcp=53 topuser=madalice 2026-08-28 09:06:46 L1=2.57 run=3 blk=0 avail=7965 (57.8%) swpO=0 conn=4 myRSS=2013 php=12 phpRSS=1455 ap=41 tcp=46 topuser=madalice 2026-08-28 09:06:46 L1=2.57 run=1 blk=0 avail=8044 (58.4%) swpO=0 conn=5 myRSS=2013 php=11 phpRSS=1348 ap=41 tcp=47 topuser=madalice 2026-08-28 09:06:56 L1=2.88 run=3 blk=0 avail=7983 (57.9%) swpO=0 conn=4 myRSS=2013 php=11 phpRSS=1392 ap=42 tcp=57 topuser=madalice 2026-08-28 09:06:56 L1=2.88 run=2 blk=0 avail=7897 (57.3%) swpO=0 conn=4 myRSS=2013 php=13 phpRSS=1531 ap=42 tcp=58 topuser=madalice 2026-08-28 09:07:06 L1=2.99 run=9 blk=0 avail=7851 (57.0%) swpO=0 conn=3 myRSS=2013 php=11 phpRSS=1443 ap=44 tcp=56 topuser=madalice 2026-08-28 09:07:06 L1=2.99 run=3 blk=0 avail=7957 (57.8%) swpO=0 conn=4 myRSS=2013 php=12 phpRSS=1429 ap=44 tcp=57 topuser=madalice 2026-08-28 09:07:16 L1=3.23 run=5 blk=0 avail=7968 (57.8%) swpO=0 conn=3 myRSS=2013 php=13 phpRSS=1471 ap=44 tcp=49 topuser=madalice 2026-08-28 09:07:16 L1=3.23 run=2 blk=0 avail=7983 (57.9%) swpO=0 conn=4 myRSS=2013 php=11 phpRSS=1389 ap=44 tcp=49 topuser=madalice 2026-08-28 09:07:26 L1=3.20 run=3 blk=0 avail=7941 (57.6%) swpO=0 conn=3 myRSS=2013 php=11 phpRSS=1462 ap=43 tcp=43 topuser=madalice 2026-08-28 09:07:26 L1=3.20 run=2 blk=0 avail=7951 (57.7%) swpO=0 conn=4 myRSS=2013 php=11 phpRSS=1449 ap=42 tcp=41 topuser=madalice 2026-08-28 09:07:36 L1=3.72 run=2 blk=0 avail=7944 (57.7%) swpO=0 conn=3 myRSS=2013 php=11 phpRSS=1366 ap=54 tcp=48 topuser=madalice 2026-08-28 09:07:36 L1=3.72 run=4 blk=0 avail=7860 (57.1%) swpO=0 conn=4 myRSS=2013 php=13 phpRSS=1533 ap=53 tcp=50 topuser=madalice