INCIDENT 2026-08-30 14:13:18 trigger: php_rss=1698MB ================================================================== load: 1.25 0.98 1.13 13/654 495099 ncpu:10 mem_avail: 6968MB/13777MB (50.6%) swap_used:1781MB swapout:46/s blocked(D):0 running:19 iowait:0.0% steal:0.0% php: 17 procs / 1698MB heaviest user: tubesupplies (8 procs, 928MB) apache: 19 procs tcp_estab: 37 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3010 root 248 981 tubesupplies 7 715 madalice 3 445 olympic 4 346 nobody 20 334 netdata 7 197 mailman 20 120 cpanellogin 1 75 dovenull 6 46 kurri 3 42 wp-toolkit 3 30 candyfabcom 2 28 mailnull 1 24 evolution 5 22 zabbix 1 21 dovecot 3 19 named 1 15 alison 1 14 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB tubesupplies 6 630 madalice 3 445 olympic 4 351 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6631 MB Active(file): 4481 MB Inactive(file): 2115 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 596 MB CommitLimit: 10984 MB Committed_AS: 8640 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 443313 root 13:17 1232 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 489033 root 2-11:54:39 7696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3082476 7.2 Ssl 2-11:54:08 /usr/sbin/mariadbd 2328310 2277352 root 207568 0.0 S 11:35:08 spamd child 508924 1 netdata 177776 1.9 Ssl 2-11:53:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175476 0.0 Ss 11:50:14 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 493594 510022 madalice 163856 11.2 S 02:27 php-fpm: pool madalice_com_au 2328311 2277352 root 160372 0.0 S 11:35:08 spamd child 494847 510022 madalice 158468 11.1 S 00:22 php-fpm: pool madalice_com_au 495026 477861 tubesupplies 155984 129 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 495031 494705 tubesupplies 149524 124 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 495023 477806 olympic 134092 101 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 494843 510022 madalice 133400 4.6 S 00:25 php-fpm: pool madalice_com_au 495035 495018 olympic 107724 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 495033 494772 tubesupplies 102536 82.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 495063 494116 olympic 79380 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4027958 1353308 cpanellogin 77320 0.0 S 03:15:05 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 495067 495012 tubesupplies 76844 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 495074 477741 olympic 65028 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 495092 495032 tubesupplies 58528 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 52836 0.0 Sl 2-11:53:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 49672 0.0 Sl 2-11:53:32 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42524 0.1 Ss 39-11:32:00 cpsrvd (SSL) - waiting for connections 2275833 1 root 35712 0.0 Ss 11:51:04 lfd - sleeping 508720 1 mailnull 25284 0.0 Ss 2-11:53:41 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 23960 0.1 Ss 62-04:03:29 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23336 0.0 Ss 2-11:53:30 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 477839 506832 nobody 22796 0.0 S 05:07 /usr/sbin/httpd -k start 477769 506832 nobody 21988 0.0 S 05:09 /usr/sbin/httpd -k start 1463 1 root 21888 0.0 Ss 62-04:03:29 tailwatchd 483898 1 zabbix 21612 0.2 Ssl 2-11:54:51 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 477419 506832 nobody 21496 0.0 S 05:35 /usr/sbin/httpd -k start 477741 506832 nobody 21420 0.0 S 05:10 /usr/sbin/httpd -k start 477778 506832 nobody 21388 0.0 S 05:09 /usr/sbin/httpd -k start 477777 506832 nobody 21320 0.0 S 05:09 /usr/sbin/httpd -k start 477861 506832 nobody 20064 0.0 S 05:06 /usr/sbin/httpd -k start 494116 506832 nobody 19760 0.0 S 01:42 /usr/sbin/httpd -k start 494772 506832 nobody 19568 0.1 S 00:35 /usr/sbin/httpd -k start 477806 506832 nobody 19468 0.0 S 05:08 /usr/sbin/httpd -k start 938582 1 wp-toolkit 17992 0.0 Ss 2-10:01:11 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 494773 506832 nobody 17536 0.0 S 00:35 /usr/sbin/httpd -k start 494705 506832 nobody 17408 0.0 S 00:38 /usr/sbin/httpd -k start 1471 1 root 16896 0.0 Ss 62-04:03:29 cPhulkd - processor 3446928 1471 root 16716 0.0 S 06:07:29 cPhulkd - dbprocessor 495019 506832 nobody 16480 0.0 S 00:04 /usr/sbin/httpd -k start 495012 506832 nobody 16424 0.0 S 00:05 /usr/sbin/httpd -k start 495018 506832 nobody 16416 0.0 S 00:04 /usr/sbin/httpd -k start 495032 506832 nobody 16412 0.0 S 00:01 /usr/sbin/httpd -k start 3960981 508511 kurri 16152 0.0 S 03:33:24 dovecot/imap 509671 508992 netdata 15768 2.1 Sl 2-11:53:32 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15652 0.0 Ssl 2-11:53:42 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 477009 508511 kurri 15564 0.0 S 06:36 dovecot/imap 306633 508511 alison 15328 0.0 S 56:51 dovecot/imap 495021 1471 root 14860 0.0 S 00:04 cPhulkd - processor - http socket 494844 508511 candyfabcom 14812 0.0 S 00:25 dovecot/imap 495020 508511 candyfabcom 14508 0.0 S 00:04 dovecot/imap 4180059 4180015 evolution 13348 0.0 Ss 2-14:13:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 478381 508511 root 12752 0.0 S 04:05 dovecot/auth -w 495095 506832 nobody 12368 0.0 S 00:00 /usr/sbin/httpd -k start 495096 506832 nobody 12368 0.0 S 00:00 /usr/sbin/httpd -k start 3883280 508511 kurri 12292 0.0 S 1-00:11:29 dovecot/imap 938585 1 wp-toolkit 11404 0.0 Ss 2-10:01:11 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4527923 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min nrg/nrgservices.net.au-ssl_log 99 tubesupplies/tubesupplies.com.au-ssl_log 69 evolution/portal.evolutionerp.com.au-ssl_log 24 madalice/madalice.com.au-ssl_log 7 aaa/aaadownunder.com.au-ssl_log 3 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 99 68.155.159.216 65 34.175.89.173 24 203.54.180.238 3 118.127.40.55 2 91.92.243.248 2 114.119.146.16 2 114.119.143.14 1 52.7.33.248 1 2a03:2880:f802:1f:: 1 206.189.22.215 1 195.178.110.247 1 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 5 GET /store/custom-design-your-own-kicks-docs/ 4 POST / 3 POST /wp-login.php 3 POST /wp-cron.php 3 GET / 2 GET /dropdown.php 1 POST /index.php 1 GET /xmlrpc.php 1 GET /www.zip 1 GET /www/.env 1 GET /ws.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/widgets/index.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sitemaps/providers/index.php 1 GET /wp-includes/rest-api/about.php --- busiest 3 vhosts: top paths + last 10 requests --- == nrg/nrgservices.net.au-ssl_log == -- top paths -- 2 GET /dropdown.php 1 GET /xmlrpc.php 1 GET /ws.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/widgets/index.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sitemaps/providers/index.php 1 GET /wp-includes/rest-api/about.php 1 GET /wp-includes/Requests/network.php -- last 10 requests -- 68.155.159.216 - - [30/Aug/2026:14:11:43 +1000] "GET /wp-includes/js/thickbox/thickbox.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:44 +1000] "GET /goat1.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:44 +1000] "GET /wp-includes/certificates/index.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:44 +1000] "GET /wp-admin/network/index.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:45 +1000] "GET /wp-includes/sitemaps/providers/index.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:45 +1000] "GET /.well-knownold/index.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:47 +1000] "GET /wp-includes/js/crop/index.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:47 +1000] "GET /wp-includes/Text/Diff/index.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:47 +1000] "GET /images/index.php HTTP/1.1" 404 5749 "-" "-" 68.155.159.216 - - [30/Aug/2026:14:11:48 +1000] "GET /wp-includes/widgets/index.php HTTP/1.1" 404 5749 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 POST / 3 GET / 2 POST /wp-login.php 2 POST /wp-cron.php 1 GET /www.zip 1 GET /www/.env 1 GET /wp-config.php.txt 1 GET /wp-config.php.orig 1 GET /wp-config.php.old 1 GET /wp-config.php~ 1 GET /wp-config.php 1 GET /web/.env -- last 10 requests -- 34.175.89.173 - - [30/Aug/2026:14:12:49 +1000] "GET /config.php HTTP/1.1" 404 152151 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:12:50 +1000] "GET /configuration.php HTTP/1.1" 404 152154 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:12:50 +1000] "GET /config.inc.php HTTP/1.1" 404 152149 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:12:50 +1000] "GET /config/config.php HTTP/1.1" 404 152155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:12:50 +1000] "GET /config/database.php HTTP/1.1" 404 152151 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:12:52 +1000] "GET /config/app.php HTTP/1.1" 404 152155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:12:58 +1000] "GET /database.php HTTP/1.1" 404 152154 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:12:59 +1000] "GET /db.php HTTP/1.1" 404 152153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:13:03 +1000] "GET /db_config.php HTTP/1.1" 404 152146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.89.173 - - [30/Aug/2026:14:13:13 +1000] "GET /database.yml HTTP/1.1" 404 152149 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:14:12:13 +1000] "GET /heartbeat.php?sentAt=1788063133&bytes=106,147,173,157&_=1787897056964 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:13 +1000] "GET /heartbeat.php?sentAt=1788063133&bytes=106,147,173,157&_=1787918095449 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:23 +1000] "GET /heartbeat.php?sentAt=1788063143&bytes=106,147,173,167&_=1787897056965 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:23 +1000] "GET /heartbeat.php?sentAt=1788063143&bytes=106,147,173,167&_=1787918095450 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:33 +1000] "GET /heartbeat.php?sentAt=1788063153&bytes=106,147,173,177&_=1787897056966 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:33 +1000] "GET /heartbeat.php?sentAt=1788063153&bytes=106,147,173,177&_=1787918095451 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:43 +1000] "GET /heartbeat.php?sentAt=1788063163&bytes=106,147,173,187&_=1787897056967 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:43 +1000] "GET /heartbeat.php?sentAt=1788063163&bytes=106,147,173,187&_=1787918095452 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:53 +1000] "GET /heartbeat.php?sentAt=1788063173&bytes=106,147,173,197&_=1787897056968 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:12:53 +1000] "GET /heartbeat.php?sentAt=1788063173&bytes=106,147,173,197&_=1787918095453 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-30 14:10:58 L1=0.80 run=1 blk=0 avail=7959 (57.8%) swpO=7 conn=3 myRSS=3015 php=4 phpRSS=437 ap=20 tcp=28 topuser=madalice 2026-08-30 14:10:58 L1=0.80 run=3 blk=0 avail=7953 (57.7%) swpO=7 conn=1 myRSS=3015 php=4 phpRSS=437 ap=20 tcp=28 topuser=madalice 2026-08-30 14:11:08 L1=0.68 run=2 blk=0 avail=8074 (58.6%) swpO=0 conn=3 myRSS=3015 php=5 phpRSS=377 ap=17 tcp=27 topuser=madalice 2026-08-30 14:11:08 L1=0.68 run=3 blk=0 avail=8047 (58.4%) swpO=0 conn=1 myRSS=3015 php=5 phpRSS=407 ap=17 tcp=25 topuser=madalice 2026-08-30 14:11:18 L1=0.89 run=1 blk=0 avail=8098 (58.8%) swpO=152 conn=1 myRSS=3011 php=4 phpRSS=350 ap=17 tcp=27 topuser=madalice 2026-08-30 14:11:18 L1=0.89 run=2 blk=0 avail=8097 (58.8%) swpO=152 conn=1 myRSS=3011 php=4 phpRSS=350 ap=17 tcp=25 topuser=madalice 2026-08-30 14:11:28 L1=0.75 run=1 blk=0 avail=8244 (59.8%) swpO=0 conn=1 myRSS=3011 php=3 phpRSS=193 ap=15 tcp=25 topuser=madalice 2026-08-30 14:11:28 L1=0.75 run=1 blk=0 avail=8243 (59.8%) swpO=0 conn=1 myRSS=3011 php=3 phpRSS=193 ap=15 tcp=25 topuser=madalice 2026-08-30 14:11:38 L1=0.71 run=5 blk=0 avail=8185 (59.4%) swpO=0 conn=1 myRSS=3011 php=4 phpRSS=264 ap=18 tcp=29 topuser=madalice 2026-08-30 14:11:38 L1=0.71 run=7 blk=0 avail=8175 (59.3%) swpO=0 conn=3 myRSS=3011 php=4 phpRSS=275 ap=18 tcp=29 topuser=madalice 2026-08-30 14:11:48 L1=0.60 run=1 blk=0 avail=8265 (60.0%) swpO=0 conn=1 myRSS=3011 php=3 phpRSS=194 ap=18 tcp=25 topuser=madalice 2026-08-30 14:11:48 L1=0.60 run=1 blk=0 avail=8266 (60.0%) swpO=0 conn=3 myRSS=3011 php=3 phpRSS=194 ap=18 tcp=25 topuser=madalice 2026-08-30 14:11:58 L1=0.66 run=2 blk=0 avail=8196 (59.5%) swpO=0 conn=1 myRSS=3011 php=4 phpRSS=302 ap=17 tcp=24 topuser=madalice 2026-08-30 14:11:58 L1=0.66 run=2 blk=0 avail=8184 (59.4%) swpO=0 conn=3 myRSS=3011 php=4 phpRSS=314 ap=17 tcp=24 topuser=madalice 2026-08-30 14:12:08 L1=0.56 run=1 blk=0 avail=8295 (60.2%) swpO=0 conn=1 myRSS=3011 php=3 phpRSS=194 ap=16 tcp=22 topuser=madalice 2026-08-30 14:12:08 L1=0.56 run=2 blk=0 avail=8296 (60.2%) swpO=0 conn=3 myRSS=3011 php=3 phpRSS=194 ap=16 tcp=22 topuser=madalice 2026-08-30 14:12:18 L1=0.63 run=2 blk=0 avail=8302 (60.3%) swpO=0 conn=2 myRSS=3011 php=3 phpRSS=198 ap=16 tcp=23 topuser=madalice 2026-08-30 14:12:18 L1=0.63 run=2 blk=0 avail=8297 (60.2%) swpO=0 conn=3 myRSS=3011 php=3 phpRSS=199 ap=16 tcp=23 topuser=madalice 2026-08-30 14:12:28 L1=0.62 run=2 blk=0 avail=8303 (60.3%) swpO=0 conn=2 myRSS=3011 php=3 phpRSS=194 ap=16 tcp=21 topuser=madalice 2026-08-30 14:12:28 L1=0.62 run=2 blk=0 avail=8303 (60.3%) swpO=0 conn=3 myRSS=3011 php=3 phpRSS=194 ap=16 tcp=21 topuser=madalice 2026-08-30 14:12:38 L1=0.59 run=1 blk=0 avail=8307 (60.3%) swpO=0 conn=2 myRSS=3011 php=3 phpRSS=194 ap=15 tcp=20 topuser=madalice 2026-08-30 14:12:38 L1=0.59 run=1 blk=0 avail=8307 (60.3%) swpO=0 conn=1 myRSS=3011 php=3 phpRSS=194 ap=15 tcp=20 topuser=madalice 2026-08-30 14:12:48 L1=0.58 run=8 blk=0 avail=7606 (55.2%) swpO=0 conn=2 myRSS=3011 php=10 phpRSS=1079 ap=19 tcp=30 topuser=tubesupplies 2026-08-30 14:12:48 L1=0.58 run=6 blk=0 avail=7549 (54.8%) swpO=14 conn=1 myRSS=3011 php=8 phpRSS=812 ap=19 tcp=30 topuser=tubesupplies 2026-08-30 14:12:58 L1=0.57 run=3 blk=0 avail=7820 (56.8%) swpO=14 conn=2 myRSS=3011 php=6 phpRSS=689 ap=22 tcp=27 topuser=madalice 2026-08-30 14:12:58 L1=0.57 run=4 blk=0 avail=7787 (56.5%) swpO=0 conn=1 myRSS=3011 php=7 phpRSS=751 ap=22 tcp=27 topuser=madalice 2026-08-30 14:13:08 L1=0.64 run=1 blk=0 avail=8018 (58.2%) swpO=0 conn=2 myRSS=3011 php=5 phpRSS=480 ap=17 tcp=23 topuser=madalice 2026-08-30 14:13:08 L1=0.64 run=4 blk=0 avail=8014 (58.2%) swpO=0 conn=1 myRSS=3011 php=6 phpRSS=522 ap=17 tcp=23 topuser=madalice 2026-08-30 14:13:18 L1=1.25 run=13 blk=0 avail=7358 (53.4%) swpO=25 conn=10 myRSS=3010 php=14 phpRSS=1424 ap=19 tcp=36 topuser=tubesupplies 2026-08-30 14:13:18 L1=1.25 run=19 blk=0 avail=6968 (50.6%) swpO=46 conn=11 myRSS=3010 php=17 phpRSS=1698 ap=19 tcp=37 topuser=tubesupplies