INCIDENT 2026-08-29 10:06:03 trigger: php_rss=1906MB ================================================================== load: 5.23 2.73 1.78 4/695 3074934 ncpu:10 mem_avail: 6718MB/13777MB (48.8%) swap_used:1224MB swapout:0/s blocked(D):0 running:5 iowait:0.1% steal:0.0% php: 15 procs / 1906MB heaviest user: madalice (10 procs, 1561MB) apache: 60 procs tcp_estab: 27 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2823 madalice 10 1561 root 250 1120 nobody 59 995 mailman 20 225 netdata 7 202 corpkicks 2 180 alison 1 88 cpanellogin 1 74 dovenull 6 59 speedlin 1 55 wp-toolkit 3 51 mailnull 3 32 evolution 7 29 lowrange 2 28 zabbix 1 23 dovecot 3 23 named 1 16 aaa 1 14 kurri 1 9 --- php workers by user --- USER PROCS RSS_MB madalice 10 1561 corpkicks 1 97 alison 1 89 speedlin 1 56 root 1 30 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4480 MB Active(file): 4404 MB Inactive(file): 946 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 906 MB CommitLimit: 10984 MB Committed_AS: 9118 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-07:47:23 7768 /usr/bin/imunify-agent-proxy 3042173 root 06:02 1288 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2890928 10.3 Ssl 1-07:46:52 /usr/sbin/mariadbd 1502903 1451906 root 193492 0.0 S 07:29:41 spamd child 508924 1 netdata 176748 2.0 Ssl 1-07:46:21 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 173948 0.0 Ss 07:42:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3059144 510022 madalice 161144 13.9 S 02:15 php-fpm: pool madalice_com_au 3059994 510022 madalice 160784 14.2 S 01:11 php-fpm: pool madalice_com_au 3060067 510022 madalice 160532 15.6 S 01:03 php-fpm: pool madalice_com_au 3062376 510022 madalice 160452 14.4 S 00:59 php-fpm: pool madalice_com_au 3074601 510022 madalice 159516 18.7 S 00:30 php-fpm: pool madalice_com_au 3074600 510022 madalice 159504 15.6 S 00:30 php-fpm: pool madalice_com_au 3060068 510022 madalice 159388 13.5 S 01:03 php-fpm: pool madalice_com_au 3060071 510022 madalice 159364 15.0 S 01:03 php-fpm: pool madalice_com_au 3060069 510022 madalice 159180 15.5 S 01:03 php-fpm: pool madalice_com_au 3074599 510022 madalice 159156 19.3 S 00:30 php-fpm: pool madalice_com_au 1502904 1451906 root 155148 0.0 S 07:29:41 spamd child 3074904 3059340 alison 99116 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 92260 0.0 Ss 1-07:46:18 /usr/lib/systemd/systemd-journald 2971632 1353308 cpanellogin 75884 0.0 S 29:08 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 64368 0.0 Sl 1-07:46:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3074905 3059026 speedlin 62336 26.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42276 0.1 Ss 38-07:24:44 cpsrvd (SSL) - waiting for connections 1451116 1 root 35992 0.0 Ss 07:43:49 lfd - sleeping 509640 508992 root 34636 0.0 Sl 1-07:46:16 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 31260 0.0 Ss 1-07:46:14 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 30760 0.0 Ss 1-05:53:55 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 24452 0.2 Ssl 1-07:47:35 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 24176 0.1 Ss 60-23:56:13 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3040692 506832 nobody 23432 0.1 S 08:35 /usr/sbin/httpd -k start 3059456 506832 nobody 22576 0.0 S 01:47 /usr/sbin/httpd -k start 1463 1 root 21888 0.0 Ss 60-23:56:13 tailwatchd 3059458 506832 nobody 21372 0.0 S 01:47 /usr/sbin/httpd -k start 3059734 506832 nobody 21284 0.0 S 01:30 /usr/sbin/httpd -k start 3059455 506832 nobody 21080 0.0 S 01:47 /usr/sbin/httpd -k start 3059712 506832 nobody 21076 0.0 S 01:31 /usr/sbin/httpd -k start 3074613 506832 nobody 20480 0.1 S 00:25 /usr/sbin/httpd -k start 3074326 506832 nobody 20472 0.0 S 00:46 /usr/sbin/httpd -k start 3074611 506832 nobody 20292 0.0 S 00:26 /usr/sbin/httpd -k start 3074647 506832 nobody 19928 0.0 S 00:24 /usr/sbin/httpd -k start 938585 1 wp-toolkit 19848 0.0 Ss 1-05:53:55 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3074321 506832 nobody 19572 0.0 S 00:47 /usr/sbin/httpd -k start 3074644 506832 nobody 19320 0.0 S 00:24 /usr/sbin/httpd -k start 3058443 506832 nobody 19300 0.0 S 03:30 /usr/sbin/httpd -k start 3074701 506832 nobody 19260 0.0 S 00:19 /usr/sbin/httpd -k start 3074612 506832 nobody 19256 0.0 S 00:25 /usr/sbin/httpd -k start 3074645 506832 nobody 19256 0.0 S 00:24 /usr/sbin/httpd -k start 3074646 506832 nobody 19256 0.0 S 00:24 /usr/sbin/httpd -k start 3074656 506832 nobody 19256 0.0 S 00:23 /usr/sbin/httpd -k start 3059026 506832 nobody 19112 0.0 S 02:26 /usr/sbin/httpd -k start 3070514 506832 nobody 18776 0.0 S 00:54 /usr/sbin/httpd -k start 3059687 506832 nobody 18540 0.0 S 01:32 /usr/sbin/httpd -k start 3062323 506832 nobody 18488 0.0 S 01:00 /usr/sbin/httpd -k start 3074325 506832 nobody 18044 0.0 S 00:46 /usr/sbin/httpd -k start 3059340 506832 nobody 17840 0.1 S 01:57 /usr/sbin/httpd -k start 509671 508992 netdata 17804 2.1 Sl 1-07:46:16 /usr/libexec/netdata/plugins.d/apps.plugin 1 3074298 506832 nobody 17444 0.0 S 00:50 /usr/sbin/httpd -k start 3059731 506832 nobody 17424 0.2 S 01:30 /usr/sbin/httpd -k start 481558 1 root 17416 0.1 Ssl 1-07:48:45 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3074718 506832 nobody 17356 0.1 S 00:17 /usr/sbin/httpd -k start 2766563 1471 root 17016 0.0 S 01:28:15 cPhulkd - dbprocessor 3074707 506832 nobody 16996 0.0 S 00:18 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3925904 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 155 aaa/aaadownunder.com.au-ssl_log 77 corpkicks/corporatekicks.com.au-ssl_log 66 madalice/madalice.com.au-ssl_log 63 corpkicks/corporatekicks.com.au 62 whiz/whizengineering.com.au-ssl_log 54 alison/alisonarts.com.au 46 alison/alisonarts.com.au-ssl_log 33 speedlin/speedlinefencing.com.au 28 speedlin/speedlinefencing.com.au-ssl_log 27 customc/customcentral.com.au-ssl_log 23 customc/customcentral.com.au 20 evolution/portal.evolutionerp.com.au-ssl_log 20 evolution/evolutionerp.com.au-ssl_log 5 infinium/infinium.net.au-ssl_log 4 (total vhosts taking traffic: 15) --- top client IPs across all vhosts (last 3 min) --- 155 34.81.157.26 126 158.23.147.79 79 4.204.200.136 74 20.104.68.135 55 20.48.147.90 54 93.123.109.53 48 16.59.145.50 42 20.220.10.235 20 203.54.180.238 7 216.73.217.13 6 118.127.40.55 2 17.166.234.176 2 103.156.21.26 1 65.111.3.87 1 45.3.42.91 --- top request paths across all vhosts (last 3 min) --- 40 GET /_next/image 20 GET /heartbeat.php 17 GET / 6 POST /wp-cron.php 5 GET /wp-login.php 4 GET /aaa.php 3 POST /wp-login.php 3 GET /wp-ws68.php 3 GET /wp-content/uploads/ 3 GET /wp-content/admin.php 3 GET /login 3 GET /goods.php 3 GET /config.php 3 GET /classwithtostring.php 3 GET /admin 3 GET /about.php 3 GET /1.php 2 GET /zoz.php 2 GET /yyy.php 2 GET /x23.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 GET /.zsh_history 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /web/.env 1 GET /@vite/env 1 GET /v2/.env 1 GET /v1/graphql 1 GET /v1/.env 1 GET /uploads../.env 1 GET /.ssh/id_rsa 1 GET /.ssh/id_ed25519 -- last 10 requests -- 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /.bash_profile HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +ht 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /.flaskenv HTTP/1.1" 404 3417 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /.env.vault HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /config/master.key HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6437.229 Mobile Saf 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /.env.openai HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /.env.anthropic HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Applebot/0.1; +http://www.apple.com/go/applebot" 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /config.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-SearchBot/1.0; +https://developer.amaz 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /secrets.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Twitterbot/1.0) Chrome/147.0.4871.12 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /sendgrid.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.4485.48 Safari/537.36; compatible; G 34.81.157.26 - - [29/Aug/2026:10:05:16 +1000] "GET /app/.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; facebookexternalhit/1.1; +http://www.facebook.com/externalhit_uatext.php)" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /xmrlpc.php 1 GET /wp.php 1 GET /wp-includes/Text/Diff/Renderer/ 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/Text 1 GET /wp-includes/sitemaps/ 1 GET /wp-includes/SimplePie/library/SimplePie/Copyright.php 1 GET /wp-includes/rest-api/search/ 1 GET /wp-includes/rest-api/fields/ 1 GET /wp-includes/js/crop/ 1 GET /wp-includes/js/ -- last 10 requests -- 20.104.68.135 - - [29/Aug/2026:10:04:43 +1000] "GET /wp-includes/Text/Diff/Renderer/ HTTP/1.1" 200 308 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/certificates/ HTTP/1.1" 200 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/html-api/ HTTP/1.1" 200 569 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/js/ HTTP/1.1" 200 2088 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /wp-includes/rest-api/search/ HTTP/1.1" 200 392 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:44 +1000] "GET /xmrlpc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /akcc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /chosen.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /inc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:10:04:45 +1000] "GET /wp-admin/images/ HTTP/1.1" 200 1548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 HEAD / 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/SimplePie/admin.php 1 GET /wp-includes/js/jcrop/Jcrop.php 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/customize/index.php 1 GET /wp-includes/ALFA_DATA/alfacgiapi/perl.alfa 1 GET /wp-file.php 1 GET /wp-content/x/index.php 1 GET /wp-content/uploads/2025/03/themes.php -- last 10 requests -- 158.23.147.79 - - [29/Aug/2026:10:05:12 +1000] "GET /wp-content/plugins/revslider/includes/external/page/index.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:14 +1000] "GET /.well-known/acme-challenge/index.php HTTP/1.1" 403 12 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:14 +1000] "GET /gebase.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:15 +1000] "GET /2.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:16 +1000] "GET /baxa1.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:18 +1000] "GET /settings.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:19 +1000] "GET /wp-content/dropdown.php HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:20 +1000] "GET /wp-content/uploads/ HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:21 +1000] "GET /wp-admin/css/colors/blue/index.php/ HTTP/1.1" 403 6789 "-" "-" 158.23.147.79 - - [29/Aug/2026:10:05:22 +1000] "GET /wp-admin.php HTTP/1.1" 403 6789 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 10:03:38 L1=2.60 run=6 blk=0 avail=8066 (58.5%) swpO=0 conn=6 myRSS=2823 php=7 phpRSS=553 ap=37 tcp=49 topuser=speedlin 2026-08-29 10:03:41 L1=2.47 run=7 blk=0 avail=8223 (59.7%) swpO=0 conn=1 myRSS=2823 php=6 phpRSS=372 ap=37 tcp=45 topuser=madalice 2026-08-29 10:03:48 L1=2.84 run=5 blk=0 avail=8259 (59.9%) swpO=0 conn=6 myRSS=2823 php=5 phpRSS=299 ap=31 tcp=34 topuser=madalice 2026-08-29 10:03:51 L1=2.93 run=4 blk=0 avail=8040 (58.4%) swpO=0 conn=3 myRSS=2823 php=6 phpRSS=537 ap=30 tcp=36 topuser=madalice 2026-08-29 10:03:58 L1=2.77 run=4 blk=0 avail=7961 (57.8%) swpO=0 conn=6 myRSS=2823 php=6 phpRSS=648 ap=30 tcp=70 topuser=madalice 2026-08-29 10:04:01 L1=2.71 run=3 blk=0 avail=8067 (58.6%) swpO=0 conn=3 myRSS=2823 php=6 phpRSS=542 ap=33 tcp=34 topuser=madalice 2026-08-29 10:04:08 L1=2.57 run=4 blk=0 avail=8066 (58.5%) swpO=0 conn=6 myRSS=2823 php=7 phpRSS=607 ap=28 tcp=38 topuser=madalice 2026-08-29 10:04:11 L1=2.61 run=5 blk=0 avail=7900 (57.3%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=777 ap=28 tcp=31 topuser=madalice 2026-08-29 10:04:18 L1=2.80 run=5 blk=0 avail=7963 (57.8%) swpO=0 conn=6 myRSS=2823 php=7 phpRSS=694 ap=31 tcp=36 topuser=madalice 2026-08-29 10:04:21 L1=2.90 run=6 blk=0 avail=7839 (56.9%) swpO=0 conn=3 myRSS=2823 php=8 phpRSS=775 ap=30 tcp=41 topuser=madalice 2026-08-29 10:04:28 L1=3.15 run=6 blk=0 avail=7879 (57.2%) swpO=0 conn=6 myRSS=2823 php=8 phpRSS=791 ap=32 tcp=44 topuser=madalice 2026-08-29 10:04:31 L1=3.21 run=5 blk=0 avail=7973 (57.9%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=649 ap=35 tcp=96 topuser=madalice 2026-08-29 10:04:38 L1=3.20 run=4 blk=0 avail=7927 (57.5%) swpO=0 conn=3 myRSS=2823 php=6 phpRSS=513 ap=60 tcp=34 topuser=madalice 2026-08-29 10:04:41 L1=3.26 run=5 blk=0 avail=7879 (57.2%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=602 ap=57 tcp=29 topuser=madalice 2026-08-29 10:04:48 L1=3.32 run=4 blk=0 avail=7872 (57.1%) swpO=0 conn=3 myRSS=2823 php=7 phpRSS=659 ap=51 tcp=32 topuser=madalice 2026-08-29 10:04:51 L1=3.13 run=4 blk=0 avail=7938 (57.6%) swpO=0 conn=4 myRSS=2823 php=7 phpRSS=610 ap=49 tcp=31 topuser=madalice 2026-08-29 10:04:58 L1=2.96 run=6 blk=0 avail=7389 (53.6%) swpO=0 conn=3 myRSS=2823 php=11 phpRSS=1309 ap=42 tcp=43 topuser=evolution 2026-08-29 10:05:01 L1=2.81 run=14 blk=0 avail=6872 (49.9%) swpO=0 conn=9 myRSS=2823 php=12 phpRSS=1745 ap=39 tcp=46 topuser=madalice 2026-08-29 10:05:08 L1=3.78 run=4 blk=0 avail=7161 (52.0%) swpO=0 conn=3 myRSS=2823 php=12 phpRSS=1394 ap=42 tcp=44 topuser=madalice 2026-08-29 10:05:12 L1=3.88 run=8 blk=0 avail=7096 (51.5%) swpO=0 conn=6 myRSS=2823 php=13 phpRSS=1609 ap=43 tcp=44 topuser=madalice 2026-08-29 10:05:18 L1=3.65 run=4 blk=0 avail=7048 (51.2%) swpO=0 conn=3 myRSS=2823 php=12 phpRSS=1570 ap=44 tcp=65 topuser=madalice 2026-08-29 10:05:22 L1=3.60 run=4 blk=1 avail=7056 (51.2%) swpO=0 conn=4 myRSS=2823 php=13 phpRSS=1644 ap=42 tcp=27 topuser=madalice 2026-08-29 10:05:28 L1=3.71 run=3 blk=0 avail=7207 (52.3%) swpO=0 conn=3 myRSS=2823 php=12 phpRSS=1498 ap=36 tcp=31 topuser=madalice 2026-08-29 10:05:32 L1=3.49 run=3 blk=0 avail=7305 (53.0%) swpO=0 conn=4 myRSS=2823 php=12 phpRSS=1432 ap=32 tcp=29 topuser=madalice 2026-08-29 10:05:39 L1=4.41 run=4 blk=0 avail=6965 (50.6%) swpO=0 conn=4 myRSS=2823 php=13 phpRSS=1771 ap=33 tcp=55 topuser=madalice 2026-08-29 10:05:43 L1=4.86 run=13 blk=0 avail=6990 (50.7%) swpO=0 conn=10 myRSS=2823 php=12 phpRSS=1646 ap=44 tcp=65 topuser=madalice 2026-08-29 10:05:49 L1=6.07 run=5 blk=0 avail=6582 (47.8%) swpO=0 conn=4 myRSS=2823 php=15 phpRSS=1946 ap=74 tcp=51 topuser=madalice 2026-08-29 10:05:53 L1=5.83 run=3 blk=0 avail=6686 (48.5%) swpO=0 conn=3 myRSS=2823 php=14 phpRSS=1842 ap=70 tcp=48 topuser=madalice 2026-08-29 10:05:59 L1=5.60 run=6 blk=0 avail=6762 (49.1%) swpO=0 conn=4 myRSS=2823 php=15 phpRSS=1831 ap=64 tcp=31 topuser=madalice 2026-08-29 10:06:03 L1=5.23 run=5 blk=0 avail=6718 (48.8%) swpO=0 conn=4 myRSS=2823 php=15 phpRSS=1906 ap=60 tcp=27 topuser=madalice