INCIDENT 2026-08-29 19:46:18 trigger: php_rss=1740MB ================================================================== load: 3.61 1.32 1.11 12/763 881468 ncpu:10 mem_avail: 6356MB/13777MB (46.1%) swap_used:1502MB swapout:338/s blocked(D):0 running:9 iowait:0.0% steal:0.0% php: 12 procs / 1740MB heaviest user: madalice (10 procs, 1698MB) apache: 133 procs tcp_estab: 151 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2802 nobody 132 2302 madalice 10 1731 root 250 1036 netdata 7 197 mailman 20 189 evolution 8 67 cpanellogin 1 63 dovenull 6 56 mailnull 5 49 wp-toolkit 3 43 zabbix 1 22 dovecot 3 22 named 1 16 kurri 1 13 polkitd 1 6 nscd 1 5 cpanelconnecttrack 1 4 rpc 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1739 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5025 MB Active(file): 4361 MB Inactive(file): 1224 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 595 MB CommitLimit: 10984 MB Committed_AS: 10547 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-17:27:38 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2869608 8.8 Rsl 1-17:27:07 /usr/sbin/mariadbd 878561 510022 madalice 251956 32.4 R 00:59 php-fpm: pool madalice_com_au 880773 510022 madalice 231820 61.0 R 00:10 php-fpm: pool madalice_com_au 880459 510022 madalice 212204 66.0 R 00:13 php-fpm: pool madalice_com_au 508924 1 netdata 176076 1.9 Ssl 1-17:26:36 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 174200 0.0 S 03:48:44 spamd child 878553 510022 madalice 164280 32.7 S 01:00 php-fpm: pool madalice_com_au 880325 510022 madalice 161520 54.6 R 00:14 php-fpm: pool madalice_com_au 878575 510022 madalice 161104 30.9 S 00:59 php-fpm: pool madalice_com_au 880224 510022 madalice 160140 61.0 R 00:15 php-fpm: pool madalice_com_au 1502904 1451906 root 160048 0.0 S 17:09:56 spamd child 880223 510022 madalice 159496 66.0 S 00:15 php-fpm: pool madalice_com_au 880771 510022 madalice 159456 67.4 S 00:10 php-fpm: pool madalice_com_au 880455 510022 madalice 159420 51.0 S 00:13 php-fpm: pool madalice_com_au 1451906 1 root 130060 0.0 Ss 17:23:11 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 114736 0.0 Ss 1-17:26:33 /usr/lib/systemd/systemd-journald 843132 1353308 cpanellogin 64752 0.1 S 09:32 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 509236 509098 root 63320 0.0 Sl 1-17:26:33 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42656 0.1 Ss 38-17:04:59 cpsrvd (SSL) - waiting for connections 881495 879245 evolution 40364 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 39704 0.0 Sl 1-17:26:31 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33320 0.0 Ss 17:24:04 lfd - sleeping 510022 1 root 28308 0.0 Ss 1-17:26:29 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25572 0.0 Ss 1-15:34:10 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 844507 506832 nobody 23544 0.0 S 07:16 /usr/sbin/httpd -k start 864121 506832 nobody 22988 0.0 S 01:58 /usr/sbin/httpd -k start 483898 1 zabbix 22936 0.2 Ssl 1-17:27:50 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 22484 0.1 Ss 61-09:36:28 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 845967 506832 nobody 22100 0.0 S 06:36 /usr/sbin/httpd -k start 864038 506832 nobody 21744 0.2 S 02:02 /usr/sbin/httpd -k start 1463 1 root 21380 0.0 Ss 61-09:36:28 tailwatchd 864070 506832 nobody 21260 0.2 S 02:00 /usr/sbin/httpd -k start 864120 506832 nobody 20884 0.2 S 01:58 /usr/sbin/httpd -k start 879371 506832 nobody 20708 0.1 S 00:29 /usr/sbin/httpd -k start 864277 506832 nobody 20584 0.3 S 01:32 /usr/sbin/httpd -k start 879349 506832 nobody 20544 0.1 S 00:29 /usr/sbin/httpd -k start 880220 506832 nobody 20500 0.2 S 00:15 /usr/sbin/httpd -k start 880522 506832 nobody 20392 0.2 S 00:12 /usr/sbin/httpd -k start 860945 506832 nobody 20264 0.2 S 04:34 /usr/sbin/httpd -k start 880313 506832 nobody 20260 0.2 S 00:14 /usr/sbin/httpd -k start 879355 506832 nobody 20248 0.0 S 00:29 /usr/sbin/httpd -k start 880145 506832 nobody 20220 0.2 S 00:16 /usr/sbin/httpd -k start 879367 506832 nobody 19972 0.0 S 00:29 /usr/sbin/httpd -k start 880394 506832 nobody 19916 0.0 S 00:13 /usr/sbin/httpd -k start 879373 506832 nobody 19820 0.0 S 00:29 /usr/sbin/httpd -k start 879369 506832 nobody 19800 0.9 S 00:29 /usr/sbin/httpd -k start 880311 506832 nobody 19748 0.0 S 00:14 /usr/sbin/httpd -k start 863938 506832 nobody 19704 0.2 S 02:11 /usr/sbin/httpd -k start 879249 506832 nobody 19612 0.0 S 00:30 /usr/sbin/httpd -k start 879245 506832 nobody 19592 0.1 S 00:30 /usr/sbin/httpd -k start 879241 506832 nobody 19576 0.0 S 00:30 /usr/sbin/httpd -k start 880537 506832 nobody 19576 0.1 S 00:12 /usr/sbin/httpd -k start 879244 506832 nobody 19572 0.1 S 00:30 /usr/sbin/httpd -k start 879255 506832 nobody 19536 0.1 S 00:30 /usr/sbin/httpd -k start 880397 506832 nobody 19536 0.1 S 00:13 /usr/sbin/httpd -k start 879243 506832 nobody 19508 0.0 S 00:30 /usr/sbin/httpd -k start 879256 506832 nobody 19384 0.1 S 00:30 /usr/sbin/httpd -k start 878433 506832 nobody 19380 0.0 S 01:04 /usr/sbin/httpd -k start 879246 506832 nobody 19376 0.0 R 00:30 /usr/sbin/httpd -k start 879374 506832 nobody 19352 0.0 S 00:29 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4155978 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4155966 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (30355,30215,24267,28038,28039,31435,27504,29650,31434,30358,30855,29710,33491,34411,30495,24095,24104,33648,28302,24099,30810,30812,30811,24101,24103,34413,31534,30494,29596,31153,31154,30813,31156,31155,31635,33533,33536, | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1005 corpkicks/corporatekicks.com.au-ssl_log 691 cosgrovecreative/cosgrovecreative.com.au-ssl_log 557 alison/testing.alisonarts.com.au-ssl_log 150 cosgrovecreative/cosgrovecreative.com.au 135 madalice/madalice.com.au-ssl_log 84 vinesit/vinesit.com.au-ssl_log 56 candyfabcom/candyfab.com.au-ssl_log 46 aaa/aaadownunder.com.au-ssl_log 34 speedlin/speedlinefencing.com.au-ssl_log 31 evolution/portal.evolutionerp.com.au-ssl_log 22 alison/alisonarts.com.au-ssl_log 1 infinium/infinium.net.au-ssl_log 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 1256 93.123.109.228 1005 40.115.94.245 150 20.203.141.11 135 20.48.179.39 130 158.23.184.117 45 35.231.130.18 31 158.23.147.79 22 203.54.180.238 19 20.63.81.20 6 118.127.40.55 4 50.6.200.195 3 37.139.53.245 3 114.119.130.40 2 40.77.167.37 2 209.141.52.196 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 22 GET /heartbeat.php 16 GET / 9 GET /api/getItem/NA 6 GET /wp-login.php 6 GET /.well-known/acme-challenge/ 6 GET /login 6 GET /404.shtml 5 POST /wp-login.php 4 POST /wp-cron.php 4 GET /.wp-config.php.swp 4 GET /.well-known/stripe.txt 4 GET /.well-known/stripe/ 4 GET /test.php 4 GET /.terraform.tfstate 4 GET /.terraform.lock.hcl --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:19:46:16 +1000] "GET /api/getItem/H5020 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:16 +1000] "GET /api/getItem/H4025 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:16 +1000] "GET /api/getItem/H4032 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:16 +1000] "GET /api/getItem/H5032 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:16 +1000] "GET /api/getItem/H5025D HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:16 +1000] "GET /api/getItem/H8025D HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:16 +1000] "GET /api/getItem/H8032D HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:17 +1000] "GET /api/getItem/H8040 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:17 +1000] "GET /api/getItem/H10025 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:19:46:17 +1000] "GET /api/getItem/H10032 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 6 GET / 3 GET /404.shtml 2 POST /wp-cron.php 2 GET /.wp-config.php.swp 2 GET /.well-known/stripe.txt 2 GET /.well-known/stripe/ 2 GET /.well-known/acme-challenge/ 2 GET /_vercel/insights 2 GET /.terraform.tfstate 2 GET /.terraform.lock.hcl 2 GET /.stripe/ 2 GET /.s3cfg -- last 10 requests -- 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /env.txt HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/env.txt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126. 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /env.yaml HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/env.yaml" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /error/ HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/error/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /etc/apache2/apache2.conf HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/etc/apache2/apache2.conf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /etc/boto.cfg HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/etc/boto.cfg" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126. 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /form-test/%2a HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/form-test/*" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /form/%2a HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/form/*" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /fr/%2a HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/fr/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /form HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/form" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /graphql HTTP/1.1" 404 3417 "http://cpanel.corporatekicks.com.au/graphql" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 7 GET / 3 GET /404.shtml 2 GET /.wp-config.php.swp 2 GET /.well-known/stripe.txt 2 GET /.well-known/stripe/ 2 GET /.well-known/acme-challenge/ 2 GET /.terraform.tfstate 2 GET /.terraform.lock.hcl 2 GET /.stripe/ 2 GET /.s3cfg 2 GET /README.md 2 GET /_profiler/phpinfo -- last 10 requests -- 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /%5btenant%5d/%2a HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/[tenant]/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, lik 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /%5bworkspace%5d/%2a HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/[workspace]/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /__debug HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/__debug" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chr 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /__nextjs_action HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/__nextjs_action" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chr 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /_api/%2a HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/_api/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chr 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /__nextjs_action/%2a HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/__nextjs_action/*" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /_layouts/%2a HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/_layouts/*" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [29/Aug/2026:19:46:18 +1000] "GET /_layouts/15/%2a HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/_layouts/15/*" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, li 93.123.109.228 - - [29/Aug/2026:19:46:19 +1000] "GET /_next/static/%2a HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/_next/static/*" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox 93.123.109.228 - - [29/Aug/2026:19:46:19 +1000] "GET /_profiler/phpinfo HTTP/1.1" 404 3417 "http://cpanel.cosgrovecreative.com.au/_profiler/phpinfo" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHT --- last 30 samples (run-up to this incident) --- 2026-08-29 19:43:48 L1=0.15 run=1 blk=0 avail=8571 (62.2%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=195 ap=15 tcp=26 topuser=madalice 2026-08-29 19:43:57 L1=0.12 run=1 blk=0 avail=8571 (62.2%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=195 ap=15 tcp=29 topuser=madalice 2026-08-29 19:43:58 L1=0.12 run=1 blk=0 avail=8568 (62.2%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=195 ap=15 tcp=29 topuser=madalice 2026-08-29 19:44:08 L1=0.34 run=3 blk=0 avail=8409 (61.0%) swpO=0 conn=1 myRSS=2812 php=5 phpRSS=413 ap=16 tcp=32 topuser=madalice 2026-08-29 19:44:08 L1=0.34 run=4 blk=0 avail=8398 (61.0%) swpO=0 conn=1 myRSS=2812 php=6 phpRSS=439 ap=18 tcp=33 topuser=aaa 2026-08-29 19:44:18 L1=0.37 run=7 blk=0 avail=8439 (61.3%) swpO=0 conn=1 myRSS=2812 php=4 phpRSS=285 ap=19 tcp=41 topuser=madalice 2026-08-29 19:44:18 L1=0.37 run=3 blk=0 avail=8413 (61.1%) swpO=0 conn=1 myRSS=2812 php=4 phpRSS=286 ap=21 tcp=47 topuser=madalice 2026-08-29 19:44:28 L1=0.46 run=2 blk=0 avail=8442 (61.3%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=196 ap=28 tcp=23 topuser=madalice 2026-08-29 19:44:28 L1=0.46 run=1 blk=0 avail=8449 (61.3%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=196 ap=27 tcp=23 topuser=madalice 2026-08-29 19:44:38 L1=0.46 run=2 blk=0 avail=8499 (61.7%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=196 ap=20 tcp=25 topuser=madalice 2026-08-29 19:44:38 L1=0.46 run=1 blk=0 avail=8510 (61.8%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=196 ap=19 tcp=25 topuser=madalice 2026-08-29 19:44:48 L1=0.55 run=1 blk=0 avail=8640 (62.7%) swpO=0 conn=1 myRSS=2812 php=2 phpRSS=41 ap=19 tcp=23 topuser=root 2026-08-29 19:44:48 L1=0.55 run=1 blk=0 avail=8639 (62.7%) swpO=0 conn=1 myRSS=2812 php=2 phpRSS=41 ap=19 tcp=23 topuser=root 2026-08-29 19:44:58 L1=0.47 run=1 blk=0 avail=8537 (62.0%) swpO=0 conn=1 myRSS=2812 php=3 phpRSS=174 ap=17 tcp=25 topuser=madalice 2026-08-29 19:44:58 L1=0.47 run=2 blk=0 avail=8491 (61.6%) swpO=0 conn=2 myRSS=2812 php=4 phpRSS=250 ap=17 tcp=25 topuser=madalice 2026-08-29 19:45:08 L1=0.63 run=2 blk=0 avail=8492 (61.6%) swpO=0 conn=1 myRSS=2812 php=5 phpRSS=258 ap=16 tcp=23 topuser=madalice 2026-08-29 19:45:08 L1=0.63 run=4 blk=0 avail=8496 (61.7%) swpO=0 conn=2 myRSS=2812 php=5 phpRSS=275 ap=16 tcp=23 topuser=madalice 2026-08-29 19:45:18 L1=0.61 run=3 blk=0 avail=8441 (61.3%) swpO=0 conn=1 myRSS=2812 php=4 phpRSS=300 ap=16 tcp=25 topuser=evolution 2026-08-29 19:45:18 L1=0.61 run=5 blk=0 avail=8444 (61.3%) swpO=0 conn=2 myRSS=2812 php=5 phpRSS=336 ap=16 tcp=26 topuser=evolution 2026-08-29 19:45:28 L1=0.59 run=1 blk=0 avail=8334 (60.5%) swpO=0 conn=1 myRSS=2812 php=6 phpRSS=452 ap=16 tcp=26 topuser=madalice 2026-08-29 19:45:28 L1=0.59 run=2 blk=0 avail=8325 (60.4%) swpO=0 conn=2 myRSS=2812 php=5 phpRSS=428 ap=16 tcp=26 topuser=madalice 2026-08-29 19:45:38 L1=0.72 run=3 blk=0 avail=8094 (58.8%) swpO=0 conn=3 myRSS=2812 php=7 phpRSS=697 ap=19 tcp=37 topuser=madalice 2026-08-29 19:45:38 L1=0.72 run=2 blk=0 avail=8215 (59.6%) swpO=0 conn=2 myRSS=2812 php=6 phpRSS=535 ap=19 tcp=32 topuser=madalice 2026-08-29 19:45:48 L1=0.69 run=4 blk=0 avail=7985 (58.0%) swpO=0 conn=3 myRSS=2812 php=7 phpRSS=667 ap=50 tcp=98 topuser=madalice 2026-08-29 19:45:48 L1=0.69 run=3 blk=0 avail=7881 (57.2%) swpO=0 conn=2 myRSS=2812 php=6 phpRSS=669 ap=50 tcp=85 topuser=madalice 2026-08-29 19:45:58 L1=0.98 run=3 blk=0 avail=7778 (56.5%) swpO=3 conn=3 myRSS=2812 php=7 phpRSS=631 ap=74 tcp=80 topuser=madalice 2026-08-29 19:45:59 L1=0.98 run=5 blk=0 avail=7832 (56.9%) swpO=3 conn=2 myRSS=2812 php=6 phpRSS=558 ap=74 tcp=78 topuser=madalice 2026-08-29 19:46:08 L1=2.01 run=7 blk=0 avail=6794 (49.3%) swpO=0 conn=3 myRSS=2812 php=11 phpRSS=1299 ap=133 tcp=116 topuser=madalice 2026-08-29 19:46:09 L1=2.01 run=13 blk=0 avail=6669 (48.4%) swpO=0 conn=2 myRSS=2812 php=13 phpRSS=1447 ap=133 tcp=135 topuser=madalice 2026-08-29 19:46:18 L1=3.61 run=9 blk=0 avail=6356 (46.1%) swpO=338 conn=6 myRSS=2802 php=12 phpRSS=1740 ap=133 tcp=151 topuser=madalice