INCIDENT 2026-08-30 22:09:13 trigger: swapout=2440/s ================================================================== load: 3.22 1.49 1.05 8/661 2125386 ncpu:10 mem_avail: 4658MB/13777MB (33.8%) swap_used:2042MB swapout:2440/s blocked(D):2 running:6 iowait:35.2% steal:0.0% php: 9 procs / 874MB heaviest user: customc (2 procs, 287MB) apache: 28 procs tcp_estab: 37 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 10 2991 mysql 1 2986 root 251 981 nobody 27 465 customc 2 291 netdata 7 198 madalice 1 182 alison 2 158 corpkicks 1 154 mailman 20 88 mailnull 4 76 cpanellogin 1 68 dovenull 6 42 wp-toolkit 3 25 zabbix 1 18 dovecot 3 17 lowrange 1 14 infinium 1 14 named 1 11 kurri 1 11 --- php workers by user --- USER PROCS RSS_MB customc 2 293 madalice 1 183 corpkicks 1 154 alison 1 141 evolution 3 92 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4240 MB Active(file): 2060 MB Inactive(file): 2323 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 503 MB CommitLimit: 10984 MB Committed_AS: 10776 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-19:50:34 5816 /usr/bin/imunify-agent-proxy 2122317 root 03:46 59340 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3058004 6.8 Ssl 2-19:50:03 /usr/sbin/mariadbd 2125151 2125150 evolution 2925948 79.5 RNs 00:25 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 2125120 510022 madalice 193704 12.0 D 00:30 php-fpm: pool madalice_com_au 889551 2277352 root 187344 0.0 S 06:03:31 spamd child 508924 1 netdata 181760 1.9 Ssl 2-19:49:32 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2125312 2124783 corpkicks 160968 18.6 R 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2125327 2125307 customc 156360 71.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2125324 2125306 customc 152784 33.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2125309 2122248 alison 148408 22.6 D 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2277352 1 root 130336 0.0 Ss 19:46:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 102032 0.0 S 19:31:03 spamd child 1718459 1353308 cpanellogin 70368 0.0 S 01:59:35 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2122317 1 root 59340 1.0 Ssl 03:46 /opt/imunify360/venv/bin/python3 -m imav.run 509640 508992 root 53464 0.0 Sl 2-19:49:27 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 47528 0.0 Sl 2-19:49:29 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41520 0.1 Ss 39-19:27:55 cpsrvd (SSL) - waiting for connections 2125329 2124782 evolution 40788 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2125328 2125308 evolution 40780 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2123437 508116 root 39896 0.7 SN 02:20 cpanellogd - waiting for child to process logs for evolution 2125122 2123437 evolution 38132 0.1 SN 00:29 cpanellogd - http logs for evolution 2275833 1 root 30212 0.0 Ss 19:46:59 lfd - sleeping 2106494 506832 nobody 24064 0.0 S 07:46 /usr/sbin/httpd -k start 509266 1 root 23764 0.0 Ss 2-19:49:29 /usr/lib/systemd/systemd-journald 2122751 2122689 root 23448 0.0 S 03:17 /usr/sbin/exim -q 1469 1 root 23264 0.1 Ss 62-11:59:24 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2125233 2125230 root 22616 1.3 R 00:12 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/clean_user_php_sessions 510022 1 root 22560 0.0 Ss 2-19:49:25 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 508720 1 mailnull 21864 0.0 Ss 2-19:49:36 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2120841 506832 nobody 21684 0.0 S 04:02 /usr/sbin/httpd -k start 2122275 506832 nobody 21208 0.0 S 03:49 /usr/sbin/httpd -k start 2122248 506832 nobody 20744 0.0 S 03:51 /usr/sbin/httpd -k start 2122758 2122751 mailnull 20728 0.0 S 03:16 /usr/sbin/exim -q 1463 1 root 20596 0.0 Ss 62-11:59:24 tailwatchd 2106455 506832 nobody 20264 0.0 S 07:48 /usr/sbin/httpd -k start 2124086 506832 nobody 19972 0.0 S 01:15 /usr/sbin/httpd -k start 2123608 506832 nobody 19712 0.0 S 02:03 /usr/sbin/httpd -k start 2124783 506832 nobody 19428 0.0 S 00:57 /usr/sbin/httpd -k start 483898 1 zabbix 19320 0.2 Ssl 2-19:50:46 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2124085 506832 nobody 19248 0.0 S 01:15 /usr/sbin/httpd -k start 2123065 506832 nobody 19164 0.0 S 02:58 /usr/sbin/httpd -k start 2123570 506832 nobody 19040 0.0 S 02:10 /usr/sbin/httpd -k start 2124083 506832 nobody 18696 0.0 S 01:16 /usr/sbin/httpd -k start 2125301 506832 nobody 18628 0.1 S 00:08 /usr/sbin/httpd -k start 2123064 506832 nobody 18620 0.0 S 02:58 /usr/sbin/httpd -k start 2124782 506832 nobody 18184 0.0 S 00:57 /usr/sbin/httpd -k start 2125304 508720 mailnull 18108 0.1 S 00:07 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2124580 506832 nobody 18100 0.0 S 01:03 /usr/sbin/httpd -k start 2124564 508720 mailnull 18000 0.0 S 01:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2124779 506832 nobody 17948 0.0 S 00:58 /usr/sbin/httpd -k start 2124082 506832 nobody 17808 0.0 S 01:19 /usr/sbin/httpd -k start 2124571 506832 nobody 17664 0.0 S 01:04 /usr/sbin/httpd -k start 1809079 508511 alison 17380 0.4 S 01:34:08 dovecot/imap 2125302 506832 nobody 16908 0.1 S 00:08 /usr/sbin/httpd -k start 2125300 506832 nobody 16636 0.1 S 00:09 /usr/sbin/httpd -k start 2125308 506832 nobody 16456 0.0 S 00:07 /usr/sbin/httpd -k start 2125305 506832 nobody 16428 0.0 S 00:07 /usr/sbin/httpd -k start 2125307 506832 nobody 16424 0.0 S 00:07 /usr/sbin/httpd -k start 2125306 506832 nobody 16300 0.1 S 00:07 /usr/sbin/httpd -k start 509671 508992 netdata 15284 2.1 Sl 2-19:49:27 /usr/libexec/netdata/plugins.d/apps.plugin 1 1471 1 root 15208 0.0 Ss 62-11:59:24 cPhulkd - processor --- processes in D state (uninterruptible IO) --- 2125312 D - /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4721367 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+------------------+------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+------------------+------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4721358 | customc_wp_mjkcu | 0 | Unlocking tables | INSERT INTO `11jOh6_actionscheduler_logs` (`action_id`, `message`, `log_date_gmt`, `log_date_local`) VALUES (28901, 'action started via WP Cron', '2026-08-30 12:09:13', '2026-08-30 12:09:13') | +---------+------------------+------+------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 59 evolution/my.evolutionerp.com.au-ssl_log 46 madalice/auction.madalice.com.au-ssl_log 45 evolution/portal.evolutionerp.com.au-ssl_log 22 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 58 52.139.37.240 45 20.151.200.44 42 101.119.81.93 22 203.54.180.238 2 147.161.213.78 1 52.167.144.218 1 40.77.167.45 1 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 17 POST /app/ajax/selectFilter.php 7 POST /functions.php 7 GET /index.php 5 POST /plugins/csvexporter/plugin.php 4 GET /app/ajax.php 3 POST /app/ajax/selectFilterSingle.php 2 GET /update/da222.php 1 POST /wp-cron.php 1 POST /inveditsubsave.php 1 POST /inveditsave.php 1 POST /inveditmansave.php 1 GET /zup.php 1 GET /z.php 1 GET /zoz.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xwpg.php 1 GET /xmrlpc.php 1 GET /xda.php --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-info.php 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/interactivity-api/index.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:22:07:14 +1000] "GET /sagax.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:14 +1000] "GET /vendor/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:14 +1000] "GET /wp-content/plugins/ftde.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:14 +1000] "GET /wp-content/uploads/admin.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:15 +1000] "GET /wp-includes/Text/Diff/Engine/ HTTP/1.1" 200 353 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:15 +1000] "GET /z.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:15 +1000] "GET /f35.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:15 +1000] "GET /file61.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:15 +1000] "GET /mah.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:22:07:16 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 17 POST /app/ajax/selectFilter.php 7 POST /functions.php 7 GET /index.php 5 POST /plugins/csvexporter/plugin.php 4 GET /app/ajax.php 3 POST /app/ajax/selectFilterSingle.php 1 POST /inveditsubsave.php 1 POST /inveditsave.php 1 POST /inveditmansave.php -- last 10 requests -- 147.161.213.78 - - [30/Aug/2026:22:08:19 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=testTagDesc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 101.119.81.93 - - [30/Aug/2026:22:08:23 +1000] "POST /inveditsave.php?call=getBomConflicts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App 101.119.81.93 - - [30/Aug/2026:22:08:38 +1000] "POST /inveditsubsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 101.119.81.93 - - [30/Aug/2026:22:08:38 +1000] "GET /index.php?page=inveditsub&id=416 HTTP/1.1" 200 19883 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 101.119.81.93 - - [30/Aug/2026:22:08:38 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 101.119.81.93 - - [30/Aug/2026:22:08:39 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinveditsub%26id%3D416&call=getUserSetting&caller=ajaxSubmitLocal&seq=11048131499 HTTP/1.1" 200 99 "https://my.evolutionerp.com.au 101.119.81.93 - - [30/Aug/2026:22:08:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 101.119.81.93 - - [30/Aug/2026:22:08:40 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 21907 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 101.119.81.93 - - [30/Aug/2026:22:08:44 +1000] "GET /index.php?page=invedit&id=141691 HTTP/1.1" 200 36115 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=416" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 101.119.81.93 - - [30/Aug/2026:22:08:44 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=141691&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; == madalice/auction.madalice.com.au-ssl_log == -- top paths -- 1 GET /zoz.php 1 GET /xwpg.php 1 GET /xda.php 1 GET /wp-login.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/admin.php 1 GET /wp-admin/maint/Jcrop.php 1 GET /wp-admin/js/index.php 1 GET /wp-access.php 1 GET /wk/index.php 1 GET /wefile.php 1 GET /update/da222.php -- last 10 requests -- 20.151.200.44 - - [30/Aug/2026:22:08:24 +1000] "GET /admin.php/pindex.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:24 +1000] "GET /admin.php/csv.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:25 +1000] "GET /admin.php/700.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:25 +1000] "GET /admin.php/007x.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:25 +1000] "GET /admin.php/heex.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:25 +1000] "GET /tf.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:25 +1000] "GET /update/da222.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:26 +1000] "GET /qi.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:26 +1000] "GET /px.php HTTP/1.1" 404 - "-" "-" 20.151.200.44 - - [30/Aug/2026:22:08:26 +1000] "GET /is.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 22:06:52 L1=0.89 run=1 blk=0 avail=8226 (59.7%) swpO=0 conn=1 myRSS=3080 php=3 phpRSS=189 ap=16 tcp=24 topuser=madalice 2026-08-30 22:06:52 L1=0.89 run=1 blk=0 avail=8226 (59.7%) swpO=0 conn=1 myRSS=3080 php=3 phpRSS=189 ap=16 tcp=24 topuser=madalice 2026-08-30 22:07:02 L1=0.84 run=2 blk=0 avail=8035 (58.3%) swpO=0 conn=1 myRSS=3080 php=4 phpRSS=380 ap=15 tcp=26 topuser=corpkicks 2026-08-30 22:07:02 L1=0.84 run=2 blk=0 avail=8018 (58.2%) swpO=0 conn=1 myRSS=3080 php=4 phpRSS=397 ap=15 tcp=27 topuser=corpkicks 2026-08-30 22:07:12 L1=0.79 run=2 blk=0 avail=8191 (59.5%) swpO=1 conn=1 myRSS=3080 php=3 phpRSS=171 ap=17 tcp=23 topuser=madalice 2026-08-30 22:07:12 L1=0.79 run=1 blk=0 avail=8190 (59.4%) swpO=1 conn=1 myRSS=3080 php=3 phpRSS=171 ap=17 tcp=23 topuser=madalice 2026-08-30 22:07:22 L1=0.67 run=2 blk=0 avail=7950 (57.7%) swpO=1 conn=1 myRSS=3080 php=3 phpRSS=171 ap=17 tcp=20 topuser=madalice 2026-08-30 22:07:23 L1=0.67 run=2 blk=0 avail=7949 (57.7%) swpO=1 conn=1 myRSS=3080 php=3 phpRSS=171 ap=17 tcp=20 topuser=madalice 2026-08-30 22:07:32 L1=0.79 run=3 blk=0 avail=7613 (55.3%) swpO=44 conn=1 myRSS=3079 php=2 phpRSS=35 ap=15 tcp=18 topuser=root 2026-08-30 22:07:33 L1=0.79 run=2 blk=0 avail=7612 (55.2%) swpO=44 conn=1 myRSS=3079 php=2 phpRSS=35 ap=15 tcp=18 topuser=root 2026-08-30 22:07:43 L1=1.04 run=3 blk=0 avail=8196 (59.5%) swpO=79 conn=1 myRSS=3078 php=3 phpRSS=167 ap=14 tcp=20 topuser=madalice 2026-08-30 22:07:43 L1=1.04 run=2 blk=0 avail=8199 (59.5%) swpO=87 conn=1 myRSS=3078 php=3 phpRSS=167 ap=14 tcp=20 topuser=madalice 2026-08-30 22:07:53 L1=1.20 run=1 blk=0 avail=8222 (59.7%) swpO=0 conn=1 myRSS=3078 php=3 phpRSS=167 ap=14 tcp=22 topuser=madalice 2026-08-30 22:07:53 L1=1.20 run=2 blk=0 avail=8219 (59.7%) swpO=0 conn=1 myRSS=3078 php=3 phpRSS=167 ap=14 tcp=22 topuser=madalice 2026-08-30 22:08:03 L1=1.25 run=3 blk=0 avail=8311 (60.3%) swpO=0 conn=1 myRSS=3078 php=2 phpRSS=35 ap=18 tcp=23 topuser=root 2026-08-30 22:08:03 L1=1.25 run=1 blk=0 avail=8312 (60.3%) swpO=0 conn=1 myRSS=3078 php=2 phpRSS=35 ap=18 tcp=24 topuser=root 2026-08-30 22:08:13 L1=1.89 run=3 blk=0 avail=8108 (58.8%) swpO=0 conn=1 myRSS=3078 php=3 phpRSS=167 ap=21 tcp=34 topuser=madalice 2026-08-30 22:08:13 L1=1.89 run=3 blk=0 avail=8088 (58.7%) swpO=0 conn=1 myRSS=3078 php=4 phpRSS=209 ap=21 tcp=35 topuser=madalice 2026-08-30 22:08:23 L1=1.91 run=1 blk=0 avail=8147 (59.1%) swpO=0 conn=1 myRSS=3078 php=3 phpRSS=167 ap=25 tcp=32 topuser=madalice 2026-08-30 22:08:23 L1=1.91 run=1 blk=0 avail=8145 (59.1%) swpO=0 conn=1 myRSS=3078 php=3 phpRSS=167 ap=25 tcp=32 topuser=madalice 2026-08-30 22:08:33 L1=2.08 run=1 blk=0 avail=8260 (60.0%) swpO=0 conn=1 myRSS=3078 php=2 phpRSS=35 ap=25 tcp=30 topuser=root 2026-08-30 22:08:33 L1=2.08 run=1 blk=0 avail=8258 (59.9%) swpO=0 conn=1 myRSS=3078 php=2 phpRSS=35 ap=25 tcp=30 topuser=root 2026-08-30 22:08:43 L1=2.08 run=2 blk=0 avail=8279 (60.1%) swpO=0 conn=1 myRSS=3078 php=2 phpRSS=35 ap=22 tcp=24 topuser=root 2026-08-30 22:08:43 L1=2.08 run=2 blk=0 avail=8272 (60.0%) swpO=0 conn=1 myRSS=3078 php=3 phpRSS=74 ap=22 tcp=25 topuser=evolution 2026-08-30 22:08:53 L1=2.29 run=3 blk=0 avail=7039 (51.1%) swpO=0 conn=2 myRSS=3078 php=3 phpRSS=171 ap=21 tcp=25 topuser=madalice 2026-08-30 22:08:53 L1=2.29 run=5 blk=0 avail=6767 (49.1%) swpO=3 conn=1 myRSS=3078 php=4 phpRSS=212 ap=21 tcp=26 topuser=madalice 2026-08-30 22:09:03 L1=2.25 run=3 blk=8 avail=5163 (37.5%) swpO=1540 conn=2 myRSS=3044 php=5 phpRSS=232 ap=21 tcp=31 topuser=madalice 2026-08-30 22:09:03 L1=2.25 run=4 blk=8 avail=5163 (37.5%) swpO=1537 conn=1 myRSS=3044 php=5 phpRSS=232 ap=21 tcp=31 topuser=madalice 2026-08-30 22:09:13 L1=3.22 run=6 blk=2 avail=4658 (33.8%) swpO=2440 conn=8 myRSS=2986 php=9 phpRSS=874 ap=28 tcp=37 topuser=customc 2026-08-30 22:09:13 L1=3.22 run=5 blk=2 avail=4652 (33.8%) swpO=2440 conn=8 myRSS=2986 php=9 phpRSS=877 ap=28 tcp=37 topuser=customc