INCIDENT 2026-08-30 12:00:28 trigger: php_rss=1511MB ================================================================== load: 1.69 0.94 0.80 8/660 52665 ncpu:10 mem_avail: 7184MB/13777MB (52.1%) swap_used:1825MB swapout:0/s blocked(D):0 running:6 iowait:0.0% steal:0.0% php: 12 procs / 1511MB heaviest user: madalice (4 procs, 656MB) apache: 31 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2924 root 249 1116 madalice 4 663 nobody 30 520 corpkicks 2 422 netdata 7 198 olympic 2 151 mailman 20 121 evolution 6 110 cpanellogin 1 63 kurri 4 56 dovenull 6 46 wp-toolkit 3 31 mailnull 1 24 zabbix 1 20 dovecot 3 19 named 1 15 candyfabcom 1 14 alison 1 14 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 4 667 corpkicks 2 425 olympic 1 127 evolution 3 117 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5307 MB Active(file): 4690 MB Inactive(file): 979 MB Dirty: 47 MB Writeback: 0 MB SReclaimable: 605 MB CommitLimit: 10984 MB Committed_AS: 8332 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 38235 root 00:28 1236 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 489033 root 2-09:41:49 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2994708 7.3 Ssl 2-09:41:18 /usr/sbin/mariadbd 2328310 2277352 root 208744 0.0 S 09:22:18 spamd child 38208 510022 madalice 207584 26.4 S 00:30 php-fpm: pool madalice_com_au 508924 1 netdata 178732 1.9 Ssl 2-09:40:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175488 0.0 Ss 09:37:24 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 52359 510022 madalice 167332 50.5 R 00:13 php-fpm: pool madalice_com_au 2328311 2277352 root 166276 0.0 S 09:22:18 spamd child 36190 510022 madalice 161344 15.3 S 04:14 php-fpm: pool madalice_com_au 38209 510022 madalice 159080 26.2 S 00:30 php-fpm: pool madalice_com_au 52605 52456 corpkicks 155188 62.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509266 1 root 147552 0.0 Ss 2-09:40:44 /usr/lib/systemd/systemd-journald 52598 52591 olympic 133980 102 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 38293 38243 evolution 91252 2.1 Rs 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 4027958 1353308 cpanellogin 64836 0.0 S 01:02:15 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 52924 0.0 Sl 2-09:40:44 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 48364 0.0 Sl 2-09:40:42 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42428 0.1 Ss 39-09:19:10 cpsrvd (SSL) - waiting for connections 2275833 1 root 35916 0.0 Ss 09:38:14 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-09:40:51 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24084 0.1 Ss 62-01:50:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23344 0.0 Ss 2-09:40:40 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 20150 506832 nobody 23188 0.0 S 08:12 /usr/sbin/httpd -k start 36476 506832 nobody 22788 0.0 S 03:32 /usr/sbin/httpd -k start 37571 506832 nobody 22664 0.0 S 01:38 /usr/sbin/httpd -k start 36471 506832 nobody 22164 0.1 S 03:32 /usr/sbin/httpd -k start 36540 506832 nobody 22056 0.0 S 03:31 /usr/sbin/httpd -k start 1463 1 root 21972 0.0 Ss 62-01:50:39 tailwatchd 37589 506832 nobody 21612 0.0 S 01:35 /usr/sbin/httpd -k start 483898 1 zabbix 21288 0.2 Ssl 2-09:42:01 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 36996 506832 nobody 20928 0.0 S 02:34 /usr/sbin/httpd -k start 37583 506832 nobody 20404 0.0 S 01:36 /usr/sbin/httpd -k start 37979 506832 nobody 20104 0.0 S 00:58 /usr/sbin/httpd -k start 37575 506832 nobody 19872 0.2 S 01:37 /usr/sbin/httpd -k start 52355 506832 nobody 19768 0.0 S 00:13 /usr/sbin/httpd -k start 52454 506832 nobody 19144 0.3 S 00:10 /usr/sbin/httpd -k start 52396 506832 nobody 19136 0.1 S 00:11 /usr/sbin/httpd -k start 52372 506832 nobody 19020 0.1 S 00:12 /usr/sbin/httpd -k start 52459 506832 nobody 19020 0.1 S 00:10 /usr/sbin/httpd -k start 52456 506832 nobody 19016 0.2 S 00:10 /usr/sbin/httpd -k start 52455 506832 nobody 18880 0.1 S 00:10 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18068 0.0 Ss 2-07:48:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 52398 506832 nobody 17992 0.0 S 00:11 /usr/sbin/httpd -k start 52452 506832 nobody 17520 0.0 S 00:10 /usr/sbin/httpd -k start 42350 506832 nobody 17428 0.0 S 00:24 /usr/sbin/httpd -k start 52609 506832 nobody 17040 0.0 S 00:01 /usr/sbin/httpd -k start 1471 1 root 16996 0.0 Ss 62-01:50:39 cPhulkd - processor 52373 506832 nobody 16976 0.0 S 00:12 /usr/sbin/httpd -k start 52453 506832 nobody 16944 2.3 S 00:10 /usr/sbin/httpd -k start 52393 506832 nobody 16916 0.0 S 00:11 /usr/sbin/httpd -k start 3446928 1471 root 16828 0.0 S 03:54:39 cPhulkd - dbprocessor 52394 506832 nobody 16592 0.1 S 00:11 /usr/sbin/httpd -k start 52591 506832 nobody 16472 0.0 S 00:02 /usr/sbin/httpd -k start 52608 506832 nobody 16440 0.0 S 00:01 /usr/sbin/httpd -k start 509671 508992 netdata 15780 2.1 Sl 2-09:40:42 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15648 0.0 Ssl 2-09:40:52 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3960981 508511 kurri 15560 0.0 S 01:20:34 dovecot/imap 4128504 508511 kurri 15352 0.0 S 33:58 dovecot/imap 4146729 508511 alison 14984 0.0 S 27:08 dovecot/imap 4128914 508511 kurri 14548 0.0 S 33:29 dovecot/imap 52328 508511 candyfabcom 14488 0.0 S 00:15 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4486007 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 397 lowrange/lowrange.com.au-ssl_log 189 vinesit/vinesit.com.au-ssl_log 60 madalice/madalice.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 20 customc/customcentral.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 397 40.115.94.245 249 52.139.37.240 20 203.54.180.238 14 1.145.54.46 7 20.104.81.161 3 118.127.40.55 2 66.249.68.66 2 160.153.252.100 2 114.119.146.16 2 114.119.130.40 1 66.249.68.65 1 2a03:2880:f802:10:: 1 201.231.244.183 1 141.148.151.77 1 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 82 GET /api/getItem/LWHG2001KG 20 GET /heartbeat.php 9 GET /api/getItem/NA 7 GET /store/asics-ex89-pink-butterfly-custom-sneakers/ 4 GET /api/getItem/PWFBW3151KG 3 POST /wp-cron.php 3 POST / 3 GET /wp-admin/maint/index.php 3 GET /store/hand-painted-nike-af1-liverpool/ 3 GET / 2 GET /zoom1.php 2 GET /wp-includes/ID3/index.php 2 GET /wp-content/uploads/min.php 2 GET /wp-content/upgrade/index.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-content/about.php 2 GET /wp-blog.php 2 GET /wp-admin/index.php 2 GET /wp-admin/css/colors/blue/index.php 2 GET /store/hand-painted-nike-af1-justin/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 82 GET /api/getItem/LWHG2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG757540-8 2 GET /api/getItem/SHSG757530-8 2 GET /api/getItem/SHSG757525-8 2 GET /api/getItem/SHSG757520-8 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:12:00:26 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:26 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:26 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:26 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:26 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:27 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:27 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:27 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:27 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:00:27 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /xl.php 1 GET /ws.php 1 GET /wso.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/widgets/about.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:11:58:42 +1000] "GET /.well-known/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [30/Aug/2026:11:58:42 +1000] "GET /wp-admin/js/about.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:58:42 +1000] "GET /comfunctions.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:58:42 +1000] "GET /images/class-config.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:58:43 +1000] "GET /wp-includes/widgets/include.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:58:43 +1000] "GET /install.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:58:43 +1000] "GET /.well-known/file.php/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:58:43 +1000] "GET /wp-includes/SimplePie/gzdecodes.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 52.139.37.240 - - [30/Aug/2026:11:58:43 +1000] "GET /wp-back.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:58:44 +1000] "GET /wp-admin/css/colors/blue/about.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-the.php 1 GET /wp-signin.php 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/bk/ -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:11:59:39 +1000] "GET /xx.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:39 +1000] "GET /wp-content/about.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:40 +1000] "GET /wp-the.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:40 +1000] "GET /ws81.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:40 +1000] "GET /a1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:40 +1000] "GET /ca5.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:41 +1000] "GET /install.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:41 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:41 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:59:41 +1000] "GET /Ov-Simple1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 11:58:07 L1=0.47 run=1 blk=0 avail=8204 (59.5%) swpO=0 conn=2 myRSS=2924 php=4 phpRSS=353 ap=16 tcp=26 topuser=madalice 2026-08-30 11:58:07 L1=0.47 run=1 blk=0 avail=8204 (59.5%) swpO=0 conn=1 myRSS=2924 php=4 phpRSS=353 ap=16 tcp=25 topuser=madalice 2026-08-30 11:58:17 L1=0.40 run=1 blk=0 avail=8216 (59.6%) swpO=0 conn=2 myRSS=2924 php=4 phpRSS=354 ap=15 tcp=27 topuser=madalice 2026-08-30 11:58:17 L1=0.40 run=1 blk=0 avail=8216 (59.6%) swpO=0 conn=1 myRSS=2924 php=4 phpRSS=354 ap=15 tcp=26 topuser=madalice 2026-08-30 11:58:27 L1=0.34 run=1 blk=0 avail=8363 (60.7%) swpO=0 conn=2 myRSS=2924 php=3 phpRSS=193 ap=15 tcp=26 topuser=madalice 2026-08-30 11:58:27 L1=0.34 run=1 blk=0 avail=8364 (60.7%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=15 tcp=26 topuser=madalice 2026-08-30 11:58:37 L1=0.36 run=1 blk=0 avail=8351 (60.6%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=16 tcp=29 topuser=madalice 2026-08-30 11:58:37 L1=0.33 run=2 blk=0 avail=8354 (60.6%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=16 tcp=29 topuser=madalice 2026-08-30 11:58:47 L1=0.38 run=1 blk=0 avail=8369 (60.7%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=16 tcp=27 topuser=madalice 2026-08-30 11:58:47 L1=0.35 run=1 blk=0 avail=8368 (60.7%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=16 tcp=27 topuser=madalice 2026-08-30 11:58:57 L1=0.56 run=1 blk=0 avail=8276 (60.1%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=30 tcp=35 topuser=madalice 2026-08-30 11:58:57 L1=0.52 run=1 blk=0 avail=8275 (60.1%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=29 tcp=35 topuser=madalice 2026-08-30 11:59:07 L1=0.48 run=1 blk=0 avail=8348 (60.6%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=20 tcp=28 topuser=madalice 2026-08-30 11:59:08 L1=0.44 run=2 blk=0 avail=8357 (60.7%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=19 tcp=27 topuser=madalice 2026-08-30 11:59:17 L1=0.40 run=2 blk=0 avail=8303 (60.3%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=282 ap=14 tcp=27 topuser=madalice 2026-08-30 11:59:18 L1=0.45 run=1 blk=0 avail=8387 (60.9%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=194 ap=14 tcp=27 topuser=madalice 2026-08-30 11:59:27 L1=0.41 run=1 blk=0 avail=8387 (60.9%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=14 tcp=27 topuser=madalice 2026-08-30 11:59:28 L1=0.46 run=2 blk=0 avail=8382 (60.8%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=193 ap=14 tcp=28 topuser=madalice 2026-08-30 11:59:37 L1=0.47 run=2 blk=0 avail=8360 (60.7%) swpO=0 conn=2 myRSS=2924 php=3 phpRSS=193 ap=15 tcp=28 topuser=madalice 2026-08-30 11:59:38 L1=0.47 run=2 blk=0 avail=8359 (60.7%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=197 ap=15 tcp=26 topuser=madalice 2026-08-30 11:59:47 L1=0.48 run=2 blk=0 avail=8181 (59.4%) swpO=0 conn=2 myRSS=2924 php=5 phpRSS=442 ap=15 tcp=28 topuser=infinium 2026-08-30 11:59:48 L1=0.48 run=3 blk=0 avail=8280 (60.1%) swpO=0 conn=1 myRSS=2924 php=4 phpRSS=316 ap=15 tcp=26 topuser=madalice 2026-08-30 11:59:57 L1=0.55 run=1 blk=0 avail=8379 (60.8%) swpO=0 conn=2 myRSS=2924 php=3 phpRSS=194 ap=15 tcp=23 topuser=madalice 2026-08-30 11:59:58 L1=0.55 run=1 blk=0 avail=8380 (60.8%) swpO=0 conn=1 myRSS=2924 php=3 phpRSS=194 ap=15 tcp=23 topuser=madalice 2026-08-30 12:00:08 L1=1.00 run=4 blk=0 avail=8028 (58.3%) swpO=0 conn=2 myRSS=2924 php=7 phpRSS=598 ap=18 tcp=28 topuser=madalice 2026-08-30 12:00:08 L1=1.00 run=3 blk=0 avail=8037 (58.3%) swpO=0 conn=1 myRSS=2924 php=7 phpRSS=599 ap=18 tcp=30 topuser=madalice 2026-08-30 12:00:18 L1=1.24 run=6 blk=0 avail=7863 (57.1%) swpO=0 conn=2 myRSS=2924 php=9 phpRSS=809 ap=22 tcp=34 topuser=madalice 2026-08-30 12:00:18 L1=1.24 run=6 blk=0 avail=7809 (56.7%) swpO=0 conn=1 myRSS=2924 php=9 phpRSS=857 ap=22 tcp=35 topuser=madalice 2026-08-30 12:00:28 L1=1.69 run=8 blk=0 avail=7213 (52.4%) swpO=0 conn=2 myRSS=2924 php=12 phpRSS=1468 ap=31 tcp=47 topuser=madalice 2026-08-30 12:00:28 L1=1.69 run=6 blk=0 avail=7184 (52.1%) swpO=0 conn=8 myRSS=2924 php=12 phpRSS=1511 ap=31 tcp=47 topuser=madalice