INCIDENT 2026-08-31 12:14:38 trigger: php_rss=1528MB ================================================================== load: 3.05 2.02 2.08 2/693 951987 ncpu:10 mem_avail: 6500MB/13777MB (47.2%) swap_used:2120MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 14 procs / 1528MB heaviest user: madalice (10 procs, 1417MB) apache: 53 procs tcp_estab: 82 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3419 madalice 11 1431 root 250 988 nobody 52 925 netdata 7 208 mailman 20 74 evolution 8 73 cpanellogin 1 62 infinium 2 55 dovenull 6 46 candyfabcom 2 28 wp-toolkit 3 21 zabbix 1 19 dovecot 3 18 mailnull 1 16 vinesit 1 14 corpkicks 1 14 alison 1 14 kurri 1 12 named 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 10 1417 evolution 2 58 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5230 MB Active(file): 4490 MB Inactive(file): 968 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 497 MB CommitLimit: 10984 MB Committed_AS: 8928 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-09:55:59 4232 /usr/bin/imunify-agent-proxy 896009 root 14:37 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 934557 root 04:36 59476 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3501956 8.5 Ssl 3-09:55:28 /usr/sbin/mariadbd 3036527 3002570 root 198696 0.1 S 09:42:56 spamd child 508924 1 netdata 189020 1.9 Ssl 3-09:54:57 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 951325 510022 madalice 163856 35.4 S 00:39 php-fpm: pool madalice_com_au 951881 510022 madalice 162116 43.8 S 00:06 php-fpm: pool madalice_com_au 951887 510022 madalice 161704 52.6 S 00:05 php-fpm: pool madalice_com_au 951888 510022 madalice 139412 28.4 S 00:05 php-fpm: pool madalice_com_au 951910 510022 madalice 139392 45.3 S 00:03 php-fpm: pool madalice_com_au 951893 510022 madalice 139264 27.0 S 00:05 php-fpm: pool madalice_com_au 3002570 1 root 137872 0.0 Ss 09:51:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 951898 510022 madalice 136388 34.7 S 00:04 php-fpm: pool madalice_com_au 951900 510022 madalice 136372 34.2 S 00:04 php-fpm: pool madalice_com_au 951902 510022 madalice 136372 33.5 S 00:04 php-fpm: pool madalice_com_au 951909 510022 madalice 136364 35.0 S 00:04 php-fpm: pool madalice_com_au 3036528 3002570 root 128104 0.0 S 09:42:56 spamd child 951974 950254 evolution 73412 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 64252 0.0 Sl 3-09:54:52 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 873062 1353308 cpanellogin 63752 0.0 S 23:20 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 61500 0.0 Ss 3-09:54:54 /usr/lib/systemd/systemd-journald 934557 1 root 59476 0.8 Ssl 04:36 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 49652 0.0 Sl 3-09:54:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 951996 950425 customc 46240 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 949496 508511 infinium 44712 0.0 S 02:57 dovecot/imap 1353308 1 root 42008 0.1 Ss 40-09:33:20 cpsrvd (SSL) - waiting for connections 3001917 1 root 34004 0.0 Ss 09:52:24 lfd - sleeping 1463 1 root 24456 0.0 Ss 63-02:04:49 tailwatchd 949191 506832 nobody 23664 0.1 S 03:25 /usr/sbin/httpd -k start 933585 506832 nobody 23088 0.0 S 05:13 /usr/sbin/httpd -k start 933984 506832 nobody 22720 0.0 S 04:51 /usr/sbin/httpd -k start 510022 1 root 22564 0.0 Ss 3-09:54:50 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 948952 506832 nobody 22384 0.1 S 03:51 /usr/sbin/httpd -k start 933267 506832 nobody 22248 0.1 S 05:33 /usr/sbin/httpd -k start 949531 506832 nobody 22172 0.1 S 02:54 /usr/sbin/httpd -k start 950244 506832 nobody 22024 0.0 S 01:58 /usr/sbin/httpd -k start 950224 506832 nobody 21760 0.0 S 01:59 /usr/sbin/httpd -k start 1469 1 root 21676 0.1 Ss 63-02:04:49 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 949878 506832 nobody 21632 0.0 S 02:21 /usr/sbin/httpd -k start 931541 506832 nobody 21516 0.0 S 07:02 /usr/sbin/httpd -k start 950116 506832 nobody 21160 0.0 S 02:04 /usr/sbin/httpd -k start 949942 506832 nobody 21020 0.0 S 02:19 /usr/sbin/httpd -k start 949933 506832 nobody 20844 0.0 S 02:20 /usr/sbin/httpd -k start 950246 506832 nobody 20764 0.1 S 01:58 /usr/sbin/httpd -k start 949381 506832 nobody 20664 0.0 S 03:06 /usr/sbin/httpd -k start 950131 506832 nobody 20656 0.0 S 02:02 /usr/sbin/httpd -k start 950564 506832 nobody 20460 0.0 S 01:35 /usr/sbin/httpd -k start 483898 1 zabbix 20216 0.2 Ssl 3-09:56:11 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 950207 506832 nobody 19460 0.0 S 02:00 /usr/sbin/httpd -k start 951939 506832 nobody 19432 1.0 S 00:01 /usr/sbin/httpd -k start 951162 506832 nobody 19380 0.0 S 00:49 /usr/sbin/httpd -k start 951938 506832 nobody 19340 2.0 S 00:01 /usr/sbin/httpd -k start 950425 506832 nobody 19172 0.3 S 01:44 /usr/sbin/httpd -k start 951913 506832 nobody 18872 0.6 S 00:03 /usr/sbin/httpd -k start 951511 506832 nobody 18724 0.0 S 00:27 /usr/sbin/httpd -k start 950253 506832 nobody 18700 0.0 S 01:58 /usr/sbin/httpd -k start 950544 506832 nobody 18368 0.0 S 01:37 /usr/sbin/httpd -k start 950245 506832 nobody 18212 0.0 S 01:58 /usr/sbin/httpd -k start 950391 506832 nobody 18188 0.0 S 01:48 /usr/sbin/httpd -k start 951185 506832 nobody 18020 0.0 S 00:47 /usr/sbin/httpd -k start 951189 506832 nobody 17960 0.1 S 00:47 /usr/sbin/httpd -k start 950254 506832 nobody 17748 0.0 S 01:58 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7698562 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 7698561 | root | 85-1559715131 | Execute | 0 | Updating | UPDATE tasks SET assignedname = 'Jack Robson' WHERE id = '20431' | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 554 evolution/portal.evolutionerp.com.au-ssl_log 222 coscom/coscom.com.au-ssl_log 159 customc/customcentral.com.au-ssl_log 131 corpkicks/corporatekicks.com.au-ssl_log 88 madalice/madalice.com.au-ssl_log 29 aaa/aaadownunder.com.au-ssl_log 26 speedlin/speedlinefencing.com.au-ssl_log 8 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 413 203.54.180.238 359 93.123.109.166 111 103.104.165.99 108 103.104.164.114 65 150.228.243.152 36 180.181.236.49 27 147.161.213.78 17 165.225.233.87 15 147.161.213.71 9 220.253.5.134 9 118.127.40.55 7 84.235.250.94 7 103.168.66.237 5 13.213.5.99 4 62.60.130.142 --- top request paths across all vhosts (last 3 min) --- 240 POST /functions.php 91 GET /heartbeat.php 83 GET /app/ajax.php 65 GET /index.php 59 POST / 59 GET /factory_session_checker.php 31 GET / 30 GET /factory_session_processed_qty.php 30 GET /factory_session_joiner.php 28 POST /wp/ 27 POST /plugins/csvexporter/plugin.php 25 GET /wp/wp/v2/posts/999999 21 POST /wp/index.php 16 POST /index.php 15 POST /clienteditsave.php 13 POST /auth/callback 13 POST /app/ajax/selectFilter.php 12 POST /app/ajax/selectFilterSingle.php 11 POST //functions.php 10 POST /wp//wp-json/batch/v1 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 240 POST /functions.php 83 GET /app/ajax.php 56 GET /index.php 27 POST /plugins/csvexporter/plugin.php 15 POST /clienteditsave.php 13 POST /app/ajax/selectFilter.php 12 POST /app/ajax/selectFilterSingle.php 11 POST //functions.php 9 POST /quoteditsave.php 9 POST /inveditsave.php 9 POST /app/ajax.php 7 POST /logsave.php -- last 10 requests -- 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6439&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29487&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29402&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2214&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [31/Aug/2026:12:14:37 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29568" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 103.104.164.114 - - [31/Aug/2026:12:14:37 +1000] "GET /index.php?page=invoicereg HTTP/1.1" 200 14528 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G 103.104.164.114 - - [31/Aug/2026:12:14:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=pickingedit&pickingid=146" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 91 GET /heartbeat.php 59 GET /factory_session_checker.php 30 GET /factory_session_processed_qty.php 30 GET /factory_session_joiner.php 6 POST /portal/register 6 GET /index.php -- last 10 requests -- 203.54.180.238 - - [31/Aug/2026:12:14:24 +1000] "GET /factory_session_joiner.php?id=34981 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [31/Aug/2026:12:14:23 +1000] "GET /heartbeat.php?sentAt=1788142463&bytes=106,148,227,127&_=1788136103055 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9 203.54.180.238 - - [31/Aug/2026:12:14:23 +1000] "GET /heartbeat.php?sentAt=1788142463&bytes=106,148,227,127&_=1787918103382 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [31/Aug/2026:12:14:25 +1000] "GET /heartbeat.php?sentAt=1788142459&bytes=106,148,227,123&_=1788137334424 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [31/Aug/2026:12:14:27 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:12:14:28 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:12:14:27 +1000] "GET /heartbeat.php?sentAt=1788142468&bytes=106,148,227,132&_=1788141208025 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8 203.54.180.238 - - [31/Aug/2026:12:14:30 +1000] "GET /heartbeat.php?sentAt=1788142470&bytes=106,148,227,134&_=1788140245329 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [31/Aug/2026:12:14:31 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [31/Aug/2026:12:14:31 +1000] "GET /factory_session_joiner.php?id=34974 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe == coscom/coscom.com.au-ssl_log == -- top paths -- 29 POST / 13 GET / 8 POST /auth/callback 7 POST /index.php 6 POST /wp-json/batch/v1 6 POST /wp/index.php 6 POST /wp/ 6 POST /signin 6 POST /api/auth/signin 5 POST /signup 5 POST /login 4 POST /wp-json/Batch/v1 -- last 10 requests -- 93.123.109.166 - - [31/Aug/2026:12:14:30 +1000] "POST /wp/?rest_route=/batch%2Fv1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr 93.123.109.166 - - [31/Aug/2026:12:14:30 +1000] "POST /wp/?rest_route=/batch/v1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrom 93.123.109.166 - - [31/Aug/2026:12:14:30 +1000] "POST /wp/wp-json/batch/v1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 93.123.109.166 - - [31/Aug/2026:12:14:30 +1000] "POST /wp/wp-json/Batch/v1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 93.123.109.166 - - [31/Aug/2026:12:14:31 +1000] "POST /wp//wp-json/batch/v1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 93.123.109.166 - - [31/Aug/2026:12:14:31 +1000] "POST /wp/wp-json/batch/v1/ HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 93.123.109.166 - - [31/Aug/2026:12:14:31 +1000] "POST /wp/blog/wp-json/batch/v1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrom 93.123.109.166 - - [31/Aug/2026:12:14:32 +1000] "POST /wp/wordpress/wp-json/batch/v1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 93.123.109.166 - - [31/Aug/2026:12:14:32 +1000] "POST /wp/index.php?rest_route=/batch/v1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec 93.123.109.166 - - [31/Aug/2026:12:14:33 +1000] "POST /wp/index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 404 - "https://coscom.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like --- last 30 samples (run-up to this incident) --- 2026-08-31 12:12:08 L1=0.98 run=2 blk=0 avail=7557 (54.9%) swpO=0 conn=3 myRSS=3419 php=6 phpRSS=442 ap=35 tcp=40 topuser=madalice 2026-08-31 12:12:17 L1=0.90 run=2 blk=0 avail=7614 (55.3%) swpO=3 conn=2 myRSS=3419 php=4 phpRSS=323 ap=35 tcp=49 topuser=madalice 2026-08-31 12:12:18 L1=0.90 run=3 blk=0 avail=7546 (54.8%) swpO=3 conn=3 myRSS=3419 php=6 phpRSS=473 ap=35 tcp=50 topuser=madalice 2026-08-31 12:12:27 L1=1.14 run=1 blk=0 avail=7599 (55.2%) swpO=1 conn=2 myRSS=3419 php=4 phpRSS=323 ap=40 tcp=50 topuser=madalice 2026-08-31 12:12:28 L1=1.14 run=2 blk=0 avail=7471 (54.2%) swpO=1 conn=3 myRSS=3419 php=6 phpRSS=509 ap=40 tcp=48 topuser=madalice 2026-08-31 12:12:37 L1=1.28 run=3 blk=0 avail=7505 (54.5%) swpO=0 conn=2 myRSS=3419 php=8 phpRSS=486 ap=45 tcp=69 topuser=evolution 2026-08-31 12:12:38 L1=1.28 run=6 blk=0 avail=7453 (54.1%) swpO=0 conn=3 myRSS=3419 php=8 phpRSS=537 ap=45 tcp=74 topuser=evolution 2026-08-31 12:12:47 L1=1.33 run=5 blk=0 avail=7424 (53.9%) swpO=0 conn=2 myRSS=3419 php=4 phpRSS=299 ap=68 tcp=76 topuser=madalice 2026-08-31 12:12:48 L1=1.33 run=1 blk=0 avail=7514 (54.5%) swpO=0 conn=3 myRSS=3419 php=4 phpRSS=207 ap=68 tcp=83 topuser=madalice 2026-08-31 12:12:57 L1=1.49 run=4 blk=0 avail=6993 (50.8%) swpO=0 conn=2 myRSS=3419 php=8 phpRSS=739 ap=79 tcp=83 topuser=customc 2026-08-31 12:12:58 L1=1.49 run=3 blk=0 avail=6994 (50.8%) swpO=0 conn=3 myRSS=3419 php=9 phpRSS=642 ap=79 tcp=83 topuser=madalice 2026-08-31 12:13:07 L1=1.33 run=1 blk=0 avail=7232 (52.5%) swpO=0 conn=2 myRSS=3419 php=5 phpRSS=372 ap=82 tcp=71 topuser=madalice 2026-08-31 12:13:08 L1=1.33 run=5 blk=0 avail=7002 (50.8%) swpO=0 conn=5 myRSS=3419 php=8 phpRSS=683 ap=82 tcp=74 topuser=madalice 2026-08-31 12:13:17 L1=1.59 run=2 blk=0 avail=7180 (52.1%) swpO=0 conn=2 myRSS=3419 php=6 phpRSS=528 ap=72 tcp=76 topuser=madalice 2026-08-31 12:13:18 L1=1.59 run=2 blk=0 avail=7167 (52.0%) swpO=0 conn=5 myRSS=3419 php=6 phpRSS=545 ap=72 tcp=76 topuser=madalice 2026-08-31 12:13:27 L1=1.75 run=4 blk=0 avail=7243 (52.6%) swpO=0 conn=2 myRSS=3419 php=8 phpRSS=604 ap=62 tcp=63 topuser=madalice 2026-08-31 12:13:28 L1=1.75 run=3 blk=0 avail=7202 (52.3%) swpO=0 conn=5 myRSS=3419 php=7 phpRSS=609 ap=62 tcp=62 topuser=madalice 2026-08-31 12:13:38 L1=1.86 run=4 blk=0 avail=7388 (53.6%) swpO=1 conn=2 myRSS=3419 php=7 phpRSS=511 ap=52 tcp=54 topuser=madalice 2026-08-31 12:13:38 L1=1.86 run=2 blk=0 avail=7442 (54.0%) swpO=1 conn=5 myRSS=3419 php=6 phpRSS=433 ap=52 tcp=49 topuser=madalice 2026-08-31 12:13:48 L1=1.96 run=7 blk=0 avail=7194 (52.2%) swpO=4 conn=5 myRSS=3419 php=13 phpRSS=878 ap=46 tcp=58 topuser=evolution 2026-08-31 12:13:48 L1=1.96 run=3 blk=0 avail=7416 (53.8%) swpO=4 conn=5 myRSS=3419 php=7 phpRSS=473 ap=46 tcp=63 topuser=madalice 2026-08-31 12:13:58 L1=1.97 run=5 blk=0 avail=7554 (54.8%) swpO=0 conn=5 myRSS=3419 php=7 phpRSS=334 ap=56 tcp=56 topuser=evolution 2026-08-31 12:13:58 L1=1.97 run=6 blk=0 avail=7541 (54.7%) swpO=0 conn=5 myRSS=3419 php=8 phpRSS=385 ap=55 tcp=56 topuser=evolution 2026-08-31 12:14:08 L1=2.21 run=4 blk=0 avail=7454 (54.1%) swpO=0 conn=5 myRSS=3419 php=8 phpRSS=506 ap=48 tcp=62 topuser=evolution 2026-08-31 12:14:08 L1=2.21 run=5 blk=0 avail=7511 (54.5%) swpO=0 conn=6 myRSS=3419 php=8 phpRSS=448 ap=48 tcp=58 topuser=evolution 2026-08-31 12:14:18 L1=2.64 run=3 blk=0 avail=7553 (54.8%) swpO=0 conn=5 myRSS=3419 php=7 phpRSS=334 ap=51 tcp=60 topuser=evolution 2026-08-31 12:14:18 L1=2.64 run=7 blk=0 avail=7374 (53.5%) swpO=0 conn=6 myRSS=3419 php=9 phpRSS=591 ap=50 tcp=63 topuser=evolution 2026-08-31 12:14:28 L1=2.39 run=1 blk=0 avail=7663 (55.6%) swpO=0 conn=5 myRSS=3419 php=4 phpRSS=230 ap=43 tcp=48 topuser=madalice 2026-08-31 12:14:28 L1=2.39 run=4 blk=0 avail=7556 (54.8%) swpO=0 conn=6 myRSS=3419 php=5 phpRSS=354 ap=42 tcp=48 topuser=madalice 2026-08-31 12:14:38 L1=3.05 run=4 blk=0 avail=6500 (47.2%) swpO=0 conn=1 myRSS=3419 php=14 phpRSS=1528 ap=53 tcp=82 topuser=madalice