INCIDENT 2026-08-31 11:14:18 trigger: php_rss=1658MB ================================================================== load: 3.85 3.39 3.01 4/685 714604 ncpu:10 mem_avail: 6537MB/13777MB (47.5%) swap_used:2082MB swapout:0/s blocked(D):0 running:6 iowait:0.1% steal:0.0% php: 15 procs / 1658MB heaviest user: madalice (8 procs, 1228MB) apache: 49 procs tcp_estab: 54 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3401 madalice 9 1242 root 250 998 nobody 48 870 netdata 7 203 aaa 2 183 evolution 7 170 mailman 20 75 cpanellogin 1 61 mailnull 4 54 dovenull 6 46 wp-toolkit 3 21 zabbix 1 19 dovecot 3 18 alison 1 15 vinesit 1 14 corpkicks 1 14 kurri 1 12 named 1 11 infinium 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 8 1228 aaa 2 184 evolution 3 162 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3998 MB Active(file): 2827 MB Inactive(file): 1273 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 507 MB CommitLimit: 10984 MB Committed_AS: 9160 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-08:55:39 4400 /usr/bin/imunify-agent-proxy 656623 root 14:17 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3482964 8.1 Ssl 3-08:55:08 /usr/sbin/mariadbd 3036527 3002570 root 208048 0.1 S 08:42:36 spamd child 508924 1 netdata 183628 1.9 Ssl 3-08:54:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 712562 510022 madalice 164652 14.9 S 02:06 php-fpm: pool madalice_com_au 712541 510022 madalice 164596 16.3 S 02:09 php-fpm: pool madalice_com_au 714376 510022 madalice 163068 34.4 S 00:11 php-fpm: pool madalice_com_au 714354 510022 madalice 162728 38.7 S 00:13 php-fpm: pool madalice_com_au 714421 510022 madalice 162156 27.9 S 00:10 php-fpm: pool madalice_com_au 714422 510022 madalice 162100 26.2 S 00:10 php-fpm: pool madalice_com_au 3002570 1 root 147112 0.0 Ss 08:51:32 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 714459 510022 madalice 139400 16.1 S 00:09 php-fpm: pool madalice_com_au 714415 510022 madalice 139268 13.3 S 00:10 php-fpm: pool madalice_com_au 3036528 3002570 root 137328 0.0 S 08:42:36 spamd child 714565 714379 aaa 100424 67.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 714570 710507 aaa 92368 61.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 714562 676548 evolution 85576 11.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 714558 691273 evolution 68260 7.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 711235 1353308 cpanellogin 63472 0.7 S 03:00 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509640 508992 root 62932 0.0 Sl 3-08:54:32 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 57912 0.0 Ss 3-08:54:34 /usr/lib/systemd/systemd-journald 509236 509098 root 48936 0.0 Sl 3-08:54:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41552 0.1 Ss 40-08:33:00 cpsrvd (SSL) - waiting for connections 3001917 1 root 33956 0.0 Ss 08:52:04 lfd - sleeping 1463 1 root 24884 0.0 Ss 63-01:04:29 tailwatchd 695671 506832 nobody 23440 0.0 S 04:51 /usr/sbin/httpd -k start 674419 506832 nobody 22616 0.0 S 11:30 /usr/sbin/httpd -k start 510022 1 root 22560 0.0 Ss 3-08:54:30 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 710507 506832 nobody 22544 0.0 S 03:27 /usr/sbin/httpd -k start 672053 506832 nobody 22520 0.0 S 13:25 /usr/sbin/httpd -k start 693640 506832 nobody 22324 0.0 S 06:49 /usr/sbin/httpd -k start 673697 506832 nobody 22236 0.0 S 12:13 /usr/sbin/httpd -k start 694909 506832 nobody 22192 0.0 S 05:39 /usr/sbin/httpd -k start 695715 506832 nobody 22040 0.0 S 04:43 /usr/sbin/httpd -k start 1469 1 root 21956 0.1 Ss 63-01:04:29 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 694886 506832 nobody 21860 0.0 S 05:40 /usr/sbin/httpd -k start 691524 506832 nobody 21364 0.0 S 08:32 /usr/sbin/httpd -k start 691273 506832 nobody 21360 0.0 S 08:45 /usr/sbin/httpd -k start 693466 506832 nobody 21264 0.0 S 07:00 /usr/sbin/httpd -k start 693549 506832 nobody 21008 0.0 S 06:54 /usr/sbin/httpd -k start 695461 506832 nobody 20980 0.0 S 05:11 /usr/sbin/httpd -k start 695700 506832 nobody 20940 0.0 S 04:45 /usr/sbin/httpd -k start 676131 506832 nobody 20864 0.0 S 10:10 /usr/sbin/httpd -k start 676548 506832 nobody 20556 0.0 S 09:32 /usr/sbin/httpd -k start 676916 506832 nobody 20480 0.0 S 09:25 /usr/sbin/httpd -k start 710524 506832 nobody 20464 0.0 S 03:23 /usr/sbin/httpd -k start 483898 1 zabbix 20092 0.2 Ssl 3-08:55:51 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 676541 506832 nobody 20076 0.0 S 09:33 /usr/sbin/httpd -k start 714379 506832 nobody 20064 0.2 S 00:11 /usr/sbin/httpd -k start 676542 506832 nobody 19940 0.0 S 09:33 /usr/sbin/httpd -k start 713822 506832 nobody 19856 0.0 S 00:44 /usr/sbin/httpd -k start 694903 506832 nobody 19836 0.0 S 05:39 /usr/sbin/httpd -k start 714413 506832 nobody 19788 0.2 S 00:10 /usr/sbin/httpd -k start 690605 506832 nobody 19612 0.0 S 09:07 /usr/sbin/httpd -k start 713823 506832 nobody 19264 0.0 S 00:44 /usr/sbin/httpd -k start 714541 506832 nobody 18980 0.2 S 00:04 /usr/sbin/httpd -k start 714412 506832 nobody 18640 0.1 S 00:10 /usr/sbin/httpd -k start 691334 506832 nobody 18268 0.0 S 08:43 /usr/sbin/httpd -k start 714472 506832 nobody 17748 0.0 S 00:08 /usr/sbin/httpd -k start 692484 506832 nobody 17576 0.0 S 07:46 /usr/sbin/httpd -k start 1471 1 root 17072 0.0 Ss 63-01:04:29 cPhulkd - processor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7102048 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 7102047 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT SUM(total) as c FROM invoiceitems WHERE jobid = ? AND jobitemid = 0 | +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 688 nrg/nrgservices.net.au-ssl_log 169 customc/customcentral.com.au-ssl_log 131 speedlin/speedlinefencing.com.au-ssl_log 112 madalice/madalice.com.au-ssl_log 57 speedlin/speedlinefencing.com.au 54 evolution/portal.evolutionerp.com.au-ssl_log 41 whiz/whizengineering.com.au-ssl_log 40 aaa/aaadownunder.com.au-ssl_log 4 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 370 203.54.180.238 168 20.240.128.207 168 158.158.54.35 119 103.104.165.99 113 4.204.224.164 76 103.104.164.114 63 101.166.96.210 45 93.123.109.164 45 180.181.236.49 42 45.148.10.40 29 150.228.243.152 12 118.127.40.55 9 182.239.240.254 7 147.161.213.71 5 13.214.146.72 --- top request paths across all vhosts (last 3 min) --- 193 POST /functions.php 153 GET /app/ajax.php 65 GET /index.php 45 POST /plugins/csvexporter/plugin.php 38 POST /app/ajax.php 32 GET /heartbeat.php 28 POST /quoteditsave.php 27 POST /app/ajax/selectFilterSingle.php 18 POST /clienteditsave.php 17 POST /jobeditsave.php 17 POST / 15 POST /app/ajax/selectFilter.php 14 GET / 12 POST /wp/ 10 POST /wp/index.php 10 POST /plugins/fencecosting/plugin.php 8 POST /logsave.php 7 POST /mfreqsave.php 7 HEAD /index.php 7 GET /plugins/fensa/fensa-ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 193 POST /functions.php 153 GET /app/ajax.php 60 GET /index.php 45 POST /plugins/csvexporter/plugin.php 38 POST /app/ajax.php 28 POST /quoteditsave.php 27 POST /app/ajax/selectFilterSingle.php 18 POST /clienteditsave.php 17 POST /jobeditsave.php 15 POST /app/ajax/selectFilter.php 10 POST /plugins/fencecosting/plugin.php 8 POST /logsave.php -- last 10 requests -- 101.166.96.210 - - [31/Aug/2026:11:14:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36990" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [31/Aug/2026:11:14:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11320" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 150.228.243.152 - - [31/Aug/2026:11:14:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [31/Aug/2026:11:14:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 2678 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29588&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [31/Aug/2026:11:14:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [31/Aug/2026:11:14:14 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 24709 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29588&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [31/Aug/2026:11:14:15 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=CL HTTP/1.1" 200 21150 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78927§ionid=0" "Mozilla/5. 203.54.180.238 - - [31/Aug/2026:11:14:15 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=CLGS HTTP/1.1" 200 12569 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78927§ionid=0" "Mozilla/ 203.54.180.238 - - [31/Aug/2026:11:14:16 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29588&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 203.54.180.238 - - [31/Aug/2026:11:14:16 +1000] "POST /quoteditsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78918" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 == nrg/nrgservices.net.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.240.128.207 - - [31/Aug/2026:11:13:43 +1000] "GET /wp-includes/customize/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 20.240.128.207 - - [31/Aug/2026:11:13:43 +1000] "GET /gmo.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:11:13:43 +1000] "GET /classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:11:13:44 +1000] "GET /404.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:11:13:44 +1000] "GET /php.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:11:13:44 +1000] "GET /init.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:11:13:45 +1000] "GET /wp-includes/js/codemirror/about.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 20.240.128.207 - - [31/Aug/2026:11:13:45 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:11:13:46 +1000] "GET /wp-includes/Requests/library/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:11:13:46 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 POST /wp-login.php 1 POST /wp-cron.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xda.php 1 GET /wp-logs.php 1 GET /wp-load.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/Engine/ -- last 10 requests -- 158.158.54.35 - - [31/Aug/2026:11:12:32 +1000] "GET /gmo.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:32 +1000] "GET /classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:33 +1000] "GET /404.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:33 +1000] "GET /php.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:33 +1000] "GET /init.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:34 +1000] "GET /wp-includes/js/codemirror/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 158.158.54.35 - - [31/Aug/2026:11:12:34 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:34 +1000] "GET /wp-includes/Requests/library/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:34 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [31/Aug/2026:11:12:35 +1000] "GET /wp-configs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-31 11:11:48 L1=5.25 run=9 blk=0 avail=6664 (48.4%) swpO=0 conn=19 myRSS=3400 php=16 phpRSS=958 ap=143 tcp=65 topuser=evolution 2026-08-31 11:11:57 L1=5.12 run=4 blk=0 avail=6868 (49.8%) swpO=0 conn=6 myRSS=3400 php=6 phpRSS=438 ap=133 tcp=56 topuser=madalice 2026-08-31 11:11:58 L1=5.12 run=3 blk=0 avail=6746 (49.0%) swpO=0 conn=19 myRSS=3400 php=8 phpRSS=650 ap=133 tcp=59 topuser=madalice 2026-08-31 11:12:07 L1=4.55 run=4 blk=0 avail=6861 (49.8%) swpO=0 conn=6 myRSS=3400 php=7 phpRSS=601 ap=123 tcp=50 topuser=madalice 2026-08-31 11:12:08 L1=4.55 run=6 blk=0 avail=6989 (50.7%) swpO=0 conn=19 myRSS=3400 php=5 phpRSS=418 ap=122 tcp=49 topuser=madalice 2026-08-31 11:12:17 L1=4.30 run=4 blk=0 avail=6797 (49.3%) swpO=0 conn=6 myRSS=3400 php=9 phpRSS=781 ap=113 tcp=50 topuser=madalice 2026-08-31 11:12:19 L1=4.30 run=9 blk=0 avail=6788 (49.3%) swpO=0 conn=19 myRSS=3400 php=13 phpRSS=955 ap=112 tcp=50 topuser=madalice 2026-08-31 11:12:27 L1=4.24 run=2 blk=0 avail=6819 (49.5%) swpO=0 conn=6 myRSS=3400 php=7 phpRSS=782 ap=103 tcp=36 topuser=madalice 2026-08-31 11:12:29 L1=4.24 run=3 blk=0 avail=6758 (49.1%) swpO=0 conn=3 myRSS=3400 php=8 phpRSS=880 ap=102 tcp=37 topuser=madalice 2026-08-31 11:12:37 L1=4.20 run=5 blk=0 avail=6907 (50.1%) swpO=0 conn=6 myRSS=3400 php=9 phpRSS=838 ap=93 tcp=34 topuser=madalice 2026-08-31 11:12:39 L1=4.20 run=2 blk=0 avail=6987 (50.7%) swpO=0 conn=3 myRSS=3400 php=6 phpRSS=671 ap=92 tcp=36 topuser=madalice 2026-08-31 11:12:47 L1=4.10 run=3 blk=0 avail=6927 (50.3%) swpO=0 conn=4 myRSS=3401 php=7 phpRSS=811 ap=83 tcp=54 topuser=madalice 2026-08-31 11:12:49 L1=4.10 run=5 blk=0 avail=6876 (49.9%) swpO=0 conn=3 myRSS=3401 php=9 phpRSS=924 ap=82 tcp=49 topuser=madalice 2026-08-31 11:12:57 L1=4.47 run=5 blk=0 avail=6961 (50.5%) swpO=0 conn=4 myRSS=3401 php=10 phpRSS=942 ap=73 tcp=46 topuser=madalice 2026-08-31 11:12:59 L1=4.47 run=4 blk=0 avail=6991 (50.7%) swpO=0 conn=3 myRSS=3401 php=10 phpRSS=916 ap=72 tcp=43 topuser=madalice 2026-08-31 11:13:07 L1=4.62 run=2 blk=0 avail=7155 (51.9%) swpO=0 conn=4 myRSS=3401 php=7 phpRSS=731 ap=63 tcp=47 topuser=madalice 2026-08-31 11:13:09 L1=4.62 run=3 blk=0 avail=7055 (51.2%) swpO=0 conn=3 myRSS=3401 php=9 phpRSS=893 ap=62 tcp=44 topuser=madalice 2026-08-31 11:13:18 L1=4.45 run=3 blk=0 avail=7127 (51.7%) swpO=0 conn=4 myRSS=3401 php=9 phpRSS=898 ap=53 tcp=37 topuser=madalice 2026-08-31 11:13:19 L1=4.34 run=3 blk=0 avail=7093 (51.5%) swpO=0 conn=3 myRSS=3401 php=9 phpRSS=951 ap=52 tcp=39 topuser=madalice 2026-08-31 11:13:28 L1=4.23 run=4 blk=0 avail=7256 (52.7%) swpO=0 conn=4 myRSS=3401 php=6 phpRSS=671 ap=44 tcp=46 topuser=madalice 2026-08-31 11:13:29 L1=4.29 run=6 blk=0 avail=7307 (53.0%) swpO=0 conn=3 myRSS=3401 php=7 phpRSS=574 ap=44 tcp=45 topuser=madalice 2026-08-31 11:13:38 L1=4.35 run=5 blk=0 avail=7396 (53.7%) swpO=0 conn=4 myRSS=3401 php=7 phpRSS=619 ap=48 tcp=46 topuser=madalice 2026-08-31 11:13:39 L1=4.40 run=12 blk=0 avail=7476 (54.3%) swpO=0 conn=3 myRSS=3401 php=8 phpRSS=560 ap=48 tcp=44 topuser=madalice 2026-08-31 11:13:48 L1=4.05 run=7 blk=0 avail=7316 (53.1%) swpO=0 conn=3 myRSS=3401 php=7 phpRSS=739 ap=42 tcp=43 topuser=madalice 2026-08-31 11:13:49 L1=3.88 run=4 blk=0 avail=7534 (54.7%) swpO=0 conn=3 myRSS=3401 php=6 phpRSS=494 ap=42 tcp=31 topuser=madalice 2026-08-31 11:13:58 L1=3.65 run=4 blk=1 avail=7587 (55.1%) swpO=0 conn=3 myRSS=3401 php=8 phpRSS=546 ap=36 tcp=43 topuser=madalice 2026-08-31 11:13:59 L1=3.52 run=4 blk=0 avail=7545 (54.8%) swpO=0 conn=3 myRSS=3401 php=5 phpRSS=407 ap=36 tcp=31 topuser=madalice 2026-08-31 11:14:08 L1=3.40 run=5 blk=0 avail=7185 (52.2%) swpO=0 conn=3 myRSS=3401 php=9 phpRSS=1031 ap=32 tcp=48 topuser=madalice 2026-08-31 11:14:09 L1=3.93 run=14 blk=0 avail=6922 (50.2%) swpO=0 conn=3 myRSS=3401 php=12 phpRSS=1338 ap=34 tcp=47 topuser=madalice 2026-08-31 11:14:18 L1=3.85 run=6 blk=0 avail=6537 (47.5%) swpO=0 conn=5 myRSS=3401 php=15 phpRSS=1658 ap=49 tcp=54 topuser=madalice