INCIDENT 2026-08-31 06:55:44 trigger: blocked=38 php_procs=44 php_rss=2862MB mysql_conn=37 ================================================================== load: 4.27 2.32 1.59 43/753 3952090 ncpu:10 mem_avail: 6020MB/13777MB (43.7%) swap_used:2006MB swapout:189/s blocked(D):38 running:9 iowait:0.2% steal:0.0% php: 44 procs / 2862MB heaviest user: speedlin (32 procs, 1951MB) apache: 92 procs tcp_estab: 77 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3242 speedlin 32 2076 nobody 91 1360 root 247 980 corpkicks 3 434 evolution 10 248 netdata 7 205 madalice 1 155 aaa 2 90 mailman 20 78 cpanellogin 1 65 dovenull 6 46 mailnull 2 33 infinium 2 28 kurri 2 25 wp-toolkit 3 23 zabbix 1 19 dovecot 3 18 lowrange 1 14 candyfabcom 1 14 --- php workers by user --- USER PROCS RSS_MB speedlin 32 2074 corpkicks 3 439 evolution 6 240 madalice 1 155 aaa 1 77 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5818 MB Active(file): 4808 MB Inactive(file): 721 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 554 MB CommitLimit: 10984 MB Committed_AS: 13943 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-04:37:05 4740 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3320316 6.5 Ssl 3-04:36:34 /usr/sbin/mariadbd 3951899 3951895 corpkicks 244828 19.6 S 00:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3036527 3002570 root 190516 0.0 S 04:24:02 spamd child 508924 1 netdata 186228 1.9 Ssl 3-04:36:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3002570 1 root 176032 0.0 Ss 04:32:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 167780 0.0 S 04:24:02 spamd child 3952021 3951890 corpkicks 164852 70.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3951750 510022 madalice 159088 17.6 S 00:13 php-fpm: pool madalice_com_au 3952009 3936223 speedlin 138100 63.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952006 3918783 speedlin 135352 35.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952028 3951936 aaa 82504 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952039 3951868 speedlin 79200 42.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952022 3951892 evolution 69380 15.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3952049 3951836 speedlin 67860 35.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3898926 1353308 cpanellogin 66712 0.1 S 13:42 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 3952045 3951930 speedlin 66488 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952050 3946878 speedlin 65696 32.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952051 3936250 speedlin 63288 28.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952030 3951681 speedlin 62264 27.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952047 3936200 speedlin 62156 25.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952054 3951870 speedlin 62096 26.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952034 3951611 speedlin 59856 23.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952058 3936248 corpkicks 58480 12.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509640 508992 root 58456 0.0 Sl 3-04:35:58 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 3952032 3936249 speedlin 57300 21.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952041 3936238 speedlin 57104 20.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952038 3951655 speedlin 56836 20.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952046 3936255 speedlin 56064 18.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952037 3951591 speedlin 56036 19.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952044 3951893 speedlin 56024 18.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952036 3951923 speedlin 54644 14.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952042 3951869 speedlin 54256 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952035 3951652 speedlin 53840 15.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952043 3936228 speedlin 53292 14.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952048 3951928 speedlin 52692 15.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952052 3936222 speedlin 52196 13.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952053 3951935 speedlin 52180 13.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952055 3951896 speedlin 52128 13.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952040 3951927 speedlin 52020 13.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952059 3951926 speedlin 50340 11.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952057 3951889 speedlin 49812 11.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3952056 3936201 speedlin 49164 11.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 45884 0.0 Ss 3-04:36:00 /usr/lib/systemd/systemd-journald 509236 509098 root 43896 0.0 Sl 3-04:36:00 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3952031 3951867 evolution 43256 4.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 41988 0.1 Ss 40-04:14:26 cpsrvd (SSL) - waiting for connections 3952099 3951925 evolution 40172 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 34972 0.0 Ss 04:33:30 lfd - sleeping 1463 1 root 26184 0.0 Ss 62-20:45:55 tailwatchd 1469 1 root 22644 0.1 Ss 62-20:45:55 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 22604 0.0 Ss 3-04:35:56 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3918783 506832 nobody 22560 0.1 S 06:00 /usr/sbin/httpd -k start 3933710 506832 nobody 21976 0.0 S 04:49 /usr/sbin/httpd -k start 3946878 506832 nobody 21076 0.0 S 00:36 /usr/sbin/httpd -k start 3936222 506832 nobody 20988 0.0 S 02:23 /usr/sbin/httpd -k start 3936250 506832 nobody 20836 0.1 S 02:22 /usr/sbin/httpd -k start 3936248 506832 nobody 20536 0.0 S 02:22 /usr/sbin/httpd -k start 3936255 506832 nobody 20512 0.0 S 02:22 /usr/sbin/httpd -k start 483898 1 zabbix 20100 0.2 Ssl 3-04:37:17 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3936201 506832 nobody 19512 0.0 S 02:24 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 5082054 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 5081898 | speedlin_wp | speedlin_wp | Query | 0 | Writing to net | SELECT option_value FROM w50Gr_options WHERE option_name = 'mwp_link_monitor_enabled' LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 264 nrg/nrgservices.net.au-ssl_log 243 customc/customcentral.com.au-ssl_log 221 speedlin/speedlinefencing.com.au-ssl_log 170 evolution/portal.evolutionerp.com.au-ssl_log 104 tubesupplies/tubesupplies.com.au 68 tubesupplies/tubesupplies.com.au-ssl_log 68 madalice/madalice.com.au-ssl_log 9 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 174 74.248.24.12 158 20.104.49.130 127 52.139.37.240 121 20.100.175.163 98 103.104.165.99 77 52.139.44.162 63 101.166.96.210 56 203.54.180.238 56 158.23.184.117 41 182.239.240.254 23 45.156.128.169 23 120.19.134.217 22 45.156.128.171 20 45.156.128.170 19 45.156.128.168 --- top request paths across all vhosts (last 3 min) --- 78 POST /functions.php 48 GET /heartbeat.php 41 GET /app/ajax.php 40 POST /app/ajax/selectFilter.php 24 GET /index.php 14 POST /itemModify.php 9 POST /plugins/csvexporter/plugin.php 9 POST / 8 POST /app/ajax.php 8 GET / 7 POST /quoteditsave.php 7 POST /app/ajax/selectFilterSingle.php 6 POST /clienteditsave.php 5 POST /purchaseaddsave.php 5 POST /plugins/fencecosting/plugin.php 5 POST //functions.php 5 GET /tool.php 5 GET /k.php 5 GET //app/ajax.php 5 GET /222.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 78 POST /functions.php 41 GET /app/ajax.php 40 POST /app/ajax/selectFilter.php 22 GET /index.php 14 POST /itemModify.php 9 POST /plugins/csvexporter/plugin.php 8 POST /app/ajax.php 7 POST /quoteditsave.php 7 POST /app/ajax/selectFilterSingle.php 6 POST /clienteditsave.php 5 POST /purchaseaddsave.php 5 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 101.166.96.210 - - [31/Aug/2026:06:55:31 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 281 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36976§ionid=0" "Mozilla/5.0 (Windows NT 10.0; 103.104.165.99 - - [31/Aug/2026:06:55:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12100&tab=filestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 101.166.96.210 - - [31/Aug/2026:06:55:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36976§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 101.166.96.210 - - [31/Aug/2026:06:55:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36976§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.165.99 - - [31/Aug/2026:06:55:40 +1000] "POST /tasksave.php?id=20415&call=getTask HTTP/1.1" 200 401 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 101.166.96.210 - - [31/Aug/2026:06:55:43 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=EA HTTP/1.1" 200 24567 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36976§ionid=0" "Mozilla/5. 101.166.96.210 - - [31/Aug/2026:06:55:43 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=EA-7 HTTP/1.1" 200 3656 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36976§ionid=0" "Mozilla/5 101.166.96.210 - - [31/Aug/2026:06:55:44 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=EA-75 HTTP/1.1" 200 3656 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36976§ionid=0" "Mozilla/ 103.104.165.99 - - [31/Aug/2026:06:55:43 +1000] "GET /index.php HTTP/1.1" 200 29484 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 103.104.165.99 - - [31/Aug/2026:06:55:45 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like == nrg/nrgservices.net.au-ssl_log == -- top paths -- 2 GET /wp-includes/Requests/library/index.php 2 GET /wp-includes/interactivity-api/index.php 2 GET /wp-content/plugins/index.php 2 GET /wp-admin/images/admin.php 2 GET /wp-admin/classwithtostring.php 2 GET /wp-access.php 2 GET /tool.php 2 GET /root.php 2 GET /new.php 2 GET /init.php 2 GET /files.php 2 GET /file.php -- last 10 requests -- 158.23.184.117 - - [31/Aug/2026:06:55:40 +1000] "GET /plugins.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:40 +1000] "GET /readme.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:40 +1000] "GET /root.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:40 +1000] "GET /style.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:41 +1000] "GET /tool.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:41 +1000] "GET /work.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:41 +1000] "GET /wp-access.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:41 +1000] "GET /wp-admin/css/colors/blue HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:41 +1000] "GET /wp-admin/css/colors/modern HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:06:55:42 +1000] "GET /wp-admin/images/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 3 GET /tool.php 2 GET /zoom1.php 2 GET /yanz.php 2 GET /wp-includes/PHPMailer/ 2 GET /wp-includes/images/media/ 2 GET /wp-good.php 2 GET /wp-content/file.php 2 GET /wp-blog.php 2 GET /wp-admin/css/colors/modern/ 2 GET /wp-admin/css/about.php 2 GET /wp-admin/ 2 GET /t.php -- last 10 requests -- 20.100.175.163 - - [31/Aug/2026:06:55:43 +1000] "GET /system_log.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:44 +1000] "GET /24.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:44 +1000] "GET /wp-admin/maint/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:44 +1000] "GET /wp-content/plugins/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:45 +1000] "GET /admin/controller/extension/extension/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 20.100.175.163 - - [31/Aug/2026:06:55:45 +1000] "GET /wp-includes/css/dist/widgets/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:45 +1000] "GET /wp-admin/images/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:46 +1000] "GET /num.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:46 +1000] "GET /wp-admin/css/colors/ocean/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [31/Aug/2026:06:55:46 +1000] "GET /wp-content/et-cache/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-31 06:53:23 L1=2.37 run=5 blk=0 avail=7257 (52.7%) swpO=0 conn=3 myRSS=3262 php=9 phpRSS=636 ap=95 tcp=96 topuser=madalice 2026-08-31 06:53:26 L1=2.34 run=3 blk=0 avail=7046 (51.1%) swpO=0 conn=4 myRSS=3262 php=12 phpRSS=921 ap=93 tcp=102 topuser=madalice 2026-08-31 06:53:33 L1=2.31 run=1 blk=0 avail=7295 (52.9%) swpO=0 conn=3 myRSS=3262 php=7 phpRSS=566 ap=86 tcp=43 topuser=madalice 2026-08-31 06:53:36 L1=2.21 run=6 blk=0 avail=7215 (52.4%) swpO=0 conn=4 myRSS=3262 php=6 phpRSS=644 ap=84 tcp=35 topuser=madalice 2026-08-31 06:53:43 L1=2.03 run=1 blk=0 avail=7385 (53.6%) swpO=0 conn=3 myRSS=3262 php=7 phpRSS=566 ap=76 tcp=34 topuser=madalice 2026-08-31 06:53:46 L1=1.87 run=1 blk=0 avail=7427 (53.9%) swpO=0 conn=4 myRSS=3262 php=5 phpRSS=485 ap=74 tcp=31 topuser=madalice 2026-08-31 06:53:53 L1=1.80 run=1 blk=0 avail=7459 (54.1%) swpO=0 conn=3 myRSS=3262 php=7 phpRSS=564 ap=66 tcp=30 topuser=madalice 2026-08-31 06:53:56 L1=1.73 run=2 blk=0 avail=7453 (54.1%) swpO=0 conn=4 myRSS=3262 php=6 phpRSS=562 ap=64 tcp=31 topuser=madalice 2026-08-31 06:54:03 L1=1.59 run=2 blk=0 avail=7345 (53.3%) swpO=0 conn=5 myRSS=3262 php=9 phpRSS=810 ap=56 tcp=27 topuser=madalice 2026-08-31 06:54:06 L1=1.63 run=2 blk=0 avail=7920 (57.5%) swpO=0 conn=4 myRSS=3262 php=3 phpRSS=99 ap=54 tcp=27 topuser=speedlin 2026-08-31 06:54:13 L1=1.66 run=2 blk=0 avail=7946 (57.7%) swpO=0 conn=5 myRSS=3262 php=5 phpRSS=182 ap=46 tcp=31 topuser=evolution 2026-08-31 06:54:16 L1=1.60 run=1 blk=0 avail=8023 (58.2%) swpO=0 conn=4 myRSS=3262 php=2 phpRSS=34 ap=44 tcp=33 topuser=root 2026-08-31 06:54:23 L1=1.56 run=1 blk=0 avail=8062 (58.5%) swpO=0 conn=5 myRSS=3262 php=4 phpRSS=115 ap=36 tcp=28 topuser=evolution 2026-08-31 06:54:26 L1=1.51 run=1 blk=0 avail=8097 (58.8%) swpO=0 conn=1 myRSS=3262 php=2 phpRSS=34 ap=34 tcp=33 topuser=root 2026-08-31 06:54:33 L1=1.39 run=3 blk=0 avail=7885 (57.2%) swpO=0 conn=5 myRSS=3262 php=6 phpRSS=374 ap=28 tcp=35 topuser=speedlin 2026-08-31 06:54:36 L1=1.36 run=2 blk=0 avail=7954 (57.7%) swpO=0 conn=1 myRSS=3262 php=4 phpRSS=272 ap=28 tcp=33 topuser=madalice 2026-08-31 06:54:43 L1=1.25 run=1 blk=0 avail=7963 (57.8%) swpO=0 conn=5 myRSS=3262 php=5 phpRSS=269 ap=30 tcp=33 topuser=madalice 2026-08-31 06:54:46 L1=1.23 run=2 blk=0 avail=7810 (56.7%) swpO=0 conn=1 myRSS=3262 php=5 phpRSS=419 ap=30 tcp=36 topuser=speedlin 2026-08-31 06:54:53 L1=1.13 run=1 blk=0 avail=7990 (58.0%) swpO=0 conn=5 myRSS=3262 php=5 phpRSS=269 ap=26 tcp=33 topuser=madalice 2026-08-31 06:54:56 L1=1.12 run=1 blk=0 avail=8014 (58.2%) swpO=0 conn=1 myRSS=3262 php=3 phpRSS=188 ap=26 tcp=32 topuser=madalice 2026-08-31 06:55:04 L1=1.11 run=3 blk=0 avail=8107 (58.8%) swpO=0 conn=3 myRSS=3262 php=4 phpRSS=115 ap=24 tcp=33 topuser=evolution 2026-08-31 06:55:06 L1=1.18 run=3 blk=0 avail=8158 (59.2%) swpO=0 conn=1 myRSS=3262 php=2 phpRSS=34 ap=24 tcp=36 topuser=root 2026-08-31 06:55:14 L1=1.25 run=1 blk=0 avail=8030 (58.3%) swpO=0 conn=3 myRSS=3262 php=5 phpRSS=237 ap=25 tcp=35 topuser=madalice 2026-08-31 06:55:16 L1=1.23 run=3 blk=1 avail=7885 (57.2%) swpO=0 conn=1 myRSS=3262 php=5 phpRSS=382 ap=25 tcp=38 topuser=speedlin 2026-08-31 06:55:24 L1=1.37 run=2 blk=0 avail=7984 (58.0%) swpO=0 conn=3 myRSS=3262 php=6 phpRSS=278 ap=31 tcp=44 topuser=evolution 2026-08-31 06:55:26 L1=1.26 run=2 blk=0 avail=7976 (57.9%) swpO=0 conn=1 myRSS=3262 php=3 phpRSS=156 ap=36 tcp=44 topuser=madalice 2026-08-31 06:55:34 L1=1.16 run=3 blk=0 avail=7861 (57.1%) swpO=0 conn=3 myRSS=3262 php=6 phpRSS=389 ap=33 tcp=32 topuser=speedlin 2026-08-31 06:55:36 L1=2.99 run=24 blk=0 avail=7275 (52.8%) swpO=0 conn=1 myRSS=3262 php=18 phpRSS=1383 ap=34 tcp=78 topuser=speedlin 2026-08-31 06:55:44 L1=4.27 run=9 blk=38 avail=6020 (43.7%) swpO=189 conn=37 myRSS=3254 php=44 phpRSS=2862 ap=92 tcp=77 topuser=speedlin 2026-08-31 06:55:47 L1=7.05 run=43 blk=0 avail=4707 (34.2%) swpO=2330 conn=34 myRSS=3177 php=36 phpRSS=3975 ap=89 tcp=64 topuser=speedlin