INCIDENT 2026-09-02 03:36:21 trigger: php_rss=1649MB ================================================================== load: 4.32 2.00 1.32 10/781 913098 ncpu:10 mem_avail: 5501MB/13777MB (39.9%) swap_used:2266MB swapout:115/s blocked(D):0 running:11 iowait:0.2% steal:0.0% php: 13 procs / 1649MB heaviest user: madalice (3 procs, 470MB) apache: 146 procs tcp_estab: 121 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3320 nobody 147 2695 root 256 1445 madalice 3 470 customc 3 429 mailman 20 400 evolution 9 347 netdata 7 206 cpanellogin 1 77 wp-toolkit 3 62 dovenull 6 46 infinium 3 43 mailnull 4 42 kurri 3 42 lowrange 2 29 vinesit 2 28 dovecot 3 19 zabbix 1 17 aaa 1 15 candyfabcom 1 14 --- php workers by user --- USER PROCS RSS_MB madalice 3 470 customc 3 437 evolution 3 332 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4655 MB Active(file): 4035 MB Inactive(file): 966 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 611 MB CommitLimit: 10984 MB Committed_AS: 10700 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-01:13:53 3368 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3400244 10.4 Ssl 5-01:17:13 /usr/sbin/mariadbd 706070 655564 root 193480 0.0 S 58:23 spamd child 912986 911245 customc 190456 85.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 508924 1 netdata 184648 1.9 Ssl 5-01:16:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 912988 894481 evolution 180304 92.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 655564 1 root 175496 0.1 Ss 01:12:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 706071 655564 root 168064 0.0 S 58:23 spamd child 913032 912459 customc 167712 71.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 894611 3929444 madalice 163684 9.8 S 02:27 php-fpm: pool madalice_com_au 913028 912461 evolution 161316 75.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 911466 3929444 madalice 159300 8.4 S 00:42 php-fpm: pool madalice_com_au 911756 3929444 madalice 158648 12.4 S 00:27 php-fpm: pool madalice_com_au 892861 892856 root 133012 3.2 Ssl 04:21 /usr/local/cpanel/bin/autossl_check --all 913048 912845 customc 118120 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 704828 1353308 cpanellogin 79528 0.1 S 01:00:27 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509640 508992 root 78020 0.0 Sl 5-01:16:37 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 44356 0.0 Sl 5-01:16:39 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41940 0.1 Ss 42-00:55:05 cpsrvd (SSL) - waiting for connections 1469 1 root 40948 0.1 Ss 64-17:26:34 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 913060 1469 root 38720 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 913109 1469 root 38700 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 913137 1469 root 38644 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 913087 1469 root 38636 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 913080 1469 root 38632 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 912846 1469 root 37840 0.0 S 00:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 897243 1469 root 37776 0.0 S 01:19 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 901152 1469 root 37776 0.0 S 01:16 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929420 1 wp-toolkit 37716 0.0 Ss 1-01:13:44 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 37048 0.0 Ss 01:13:30 lfd - sleeping 3929444 1 root 29112 0.0 Ss 1-01:13:44 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1466 1 root 25728 0.0 Ss 64-17:26:34 dnsadmin - server mode 1463 1 root 24968 0.0 Ss 64-17:26:34 tailwatchd 3929564 1 wp-toolkit 23900 0.0 Ss 1-01:13:43 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 892986 506832 nobody 23464 0.1 S 04:14 /usr/sbin/httpd -k start 911799 911780 root 23436 0.2 S 00:26 /usr/sbin/exim -q 876204 506832 nobody 23268 0.0 S 08:29 /usr/sbin/httpd -k start 895775 506832 nobody 23100 0.1 S 01:44 /usr/sbin/httpd -k start 893971 506832 nobody 23024 0.1 S 03:10 /usr/sbin/httpd -k start 894737 506832 nobody 22560 0.1 S 02:23 /usr/sbin/httpd -k start 895771 506832 nobody 22496 0.0 S 01:44 /usr/sbin/httpd -k start 894721 506832 nobody 22008 0.1 S 02:23 /usr/sbin/httpd -k start 894474 506832 nobody 21988 0.1 S 02:40 /usr/sbin/httpd -k start 894744 506832 nobody 21856 0.1 S 02:23 /usr/sbin/httpd -k start 894726 506832 nobody 21812 0.0 S 02:23 /usr/sbin/httpd -k start 911245 506832 nobody 21812 0.1 S 00:52 /usr/sbin/httpd -k start 909732 506832 nobody 21748 0.1 S 01:10 /usr/sbin/httpd -k start 895781 506832 nobody 21628 0.0 S 01:44 /usr/sbin/httpd -k start 654699 654679 mailman 21616 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 654686 654679 mailman 21568 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 654700 654679 mailman 21540 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 654684 654679 mailman 21524 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654688 654679 mailman 21476 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 654695 654679 mailman 21472 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 654690 654679 mailman 21452 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 654693 654679 mailman 21404 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 654687 654679 mailman 21364 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 894716 506832 nobody 21356 0.0 S 02:23 /usr/sbin/httpd -k start 894673 506832 nobody 21336 0.0 S 02:24 /usr/sbin/httpd -k start 654692 654679 mailman 21328 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 654689 654679 mailman 21320 0.0 S 01:13:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15551281 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 344 coscom/coscom.com.au-ssl_log 297 alison/alisonarts.com.au-ssl_log 292 cosgrovecreative/cosgrovecreative.com.au-ssl_log 271 madalice/madalice.com.au-ssl_log 178 customc/customcentral.com.au-ssl_log 158 candyfabcom/candyfab.com.au-ssl_log 153 evolution/app.evolutionerp.com.au-ssl_log 137 aaa/aaadownunder.com.au 99 evolution/evolutionerp.com.au 84 coscom/coscom.com.au 81 evolution/evolutionerp.com.au-ssl_log 75 kurri/kurrimotorinn.com.au 66 kurri/kurrimotorinn.com.au-ssl_log 62 alison/alisonarts.com.au 58 (total vhosts taking traffic: 30) --- top client IPs across all vhosts (last 3 min) --- 250 192.168.0.2 180 130.12.180.117 162 159.89.174.87 137 40.115.94.245 136 4.204.224.164 112 159.223.132.86 102 87.58.197.201 95 206.189.95.232 84 206.189.19.19 73 167.71.175.236 71 209.97.180.8 66 146.190.242.161 62 87.58.197.202 59 164.90.208.56 59 130.12.182.254 --- top request paths across all vhosts (last 3 min) --- 556 GET / 81 GET /console/ 78 GET /server 75 GET /server-status 72 GET /.env 70 GET /about 66 GET /login.action 62 GET /___proxy_subdomain_whm/login 56 GET /autodiscover/autodiscover.xml 52 GET /___proxy_subdomain_cpanel 50 GET /v2/_catalog 49 GET /.DS_Store 47 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application 45 POST /graphql 45 POST /api 45 GET /.git/config 41 POST /graphql/api 41 POST /api/graphql 41 POST /api/gql 36 GET /s/5353e20343e2732313e2831313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 59 GET / 17 GET /.env 14 GET /.git/HEAD 8 GET /server 8 GET /console/ 7 GET /server-status 5 GET /about 4 GET /login.action 4 GET /functions/.env 4 GET /.env.staging 4 GET /.env.save 4 GET /.env.production -- last 10 requests -- 46.101.1.225 - - [02/Sep/2026:03:36:16 +1000] "GET /server HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.172.232.142 - - [02/Sep/2026:03:36:16 +1000] "GET / HTTP/1.1" 401 36 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 178.128.207.138 - - [02/Sep/2026:03:36:17 +1000] "GET /server-status HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 68.183.9.16 - - [02/Sep/2026:03:36:18 +1000] "GET /login.action HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 64.226.65.160 - - [02/Sep/2026:03:36:18 +1000] "GET /server-status HTTP/1.1" 400 52 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 139.59.143.102 - - [02/Sep/2026:03:36:18 +1000] "GET /server HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 46.101.1.225 - - [02/Sep/2026:03:36:19 +1000] "GET /server-status HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 178.128.207.138 - - [02/Sep/2026:03:36:19 +1000] "GET /about HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 68.183.9.16 - - [02/Sep/2026:03:36:19 +1000] "GET / HTTP/1.1" 200 12486 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 64.23.218.208 - - [02/Sep/2026:03:36:20 +1000] "LEAKIX" 404 - "-" "-" == coscom/coscom.com.au-ssl_log == -- top paths -- 60 GET / 10 GET /server 10 GET /console/ 9 POST /graphql/api 9 POST /graphql 9 POST /api/graphql 9 POST /api/gql 9 POST /api 9 OPTIONS / 9 GET /.well-known/security.txt 9 GET /@vite/env 9 GET /v2/_catalog -- last 10 requests -- 130.12.182.254 - - [02/Sep/2026:03:35:48 +1000] "GET / HTTP/1.1" 200 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 130.12.182.254 - - [02/Sep/2026:03:35:48 +1000] "GET / HTTP/1.1" 401 36 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 130.12.182.254 - - [02/Sep/2026:03:35:48 +1000] "GET / HTTP/1.1" 200 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 130.12.182.254 - - [02/Sep/2026:03:35:48 +1000] "GET / HTTP/1.1" 200 890 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 130.12.182.254 - - [02/Sep/2026:03:35:48 +1000] "GET / HTTP/1.1" 401 36 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 130.12.182.254 - - [02/Sep/2026:03:35:48 +1000] "GET / HTTP/1.1" 200 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 130.12.182.254 - - [02/Sep/2026:03:35:48 +1000] "GET / HTTP/1.1" 200 40068 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 68.183.9.16 - - [02/Sep/2026:03:35:55 +1000] "GET / HTTP/1.1" 200 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 68.183.9.16 - - [02/Sep/2026:03:35:57 +1000] "GET /console/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 68.183.9.16 - - [02/Sep/2026:03:35:58 +1000] "GET /server HTTP/1.1" 404 - "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" == alison/alisonarts.com.au-ssl_log == -- top paths -- 63 GET / 10 POST /graphql/api 10 POST /graphql 10 POST /api/graphql 10 POST /api/gql 10 POST /api 10 GET /.well-known/security.txt 10 GET /telescope/requests 10 GET /s/5353e20343e2732313e2831313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties 10 GET /info.php 10 GET /.git/config 10 GET /.env -- last 10 requests -- 207.154.197.113 - - [02/Sep/2026:03:35:14 +1000] "GET /actuator/env HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 164.90.208.56 - - [02/Sep/2026:03:35:14 +1000] "GET /debug/default/view?panel=config HTTP/1.1" 401 53 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 207.154.197.113 - - [02/Sep/2026:03:35:16 +1000] "GET /trace.axd HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 209.38.208.202 - - [02/Sep/2026:03:35:15 +1000] "GET /.well-known/security.txt HTTP/1.1" 404 15459 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.71.175.236 - - [02/Sep/2026:03:35:15 +1000] "POST /wp-json/batch/v1 HTTP/1.1" 207 628 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 139.59.132.8 - - [02/Sep/2026:03:35:15 +1000] "GET /.well-known/security.txt HTTP/1.1" 404 49472 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 207.154.197.113 - - [02/Sep/2026:03:35:18 +1000] "GET /@vite/env HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 209.38.208.202 - - [02/Sep/2026:03:35:18 +1000] "GET /actuator/env HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 167.71.175.236 - - [02/Sep/2026:03:35:18 +1000] "POST /wp-json/batch/v1 HTTP/1.1" 207 628 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" 139.59.132.8 - - [02/Sep/2026:03:35:18 +1000] "GET /actuator/env HTTP/1.1" 404 49472 "-" "Mozilla/5.0 (l9scan/2.0.5353e20343e2732313e2831313; +https://leakix.net)" --- last 30 samples (run-up to this incident) --- 2026-09-02 03:34:01 L1=0.99 run=3 blk=0 avail=7145 (51.9%) swpO=0 conn=1 myRSS=3330 php=4 phpRSS=305 ap=88 tcp=56 topuser=madalice 2026-09-02 03:34:01 L1=0.99 run=2 blk=0 avail=7112 (51.6%) swpO=0 conn=2 myRSS=3330 php=4 phpRSS=338 ap=88 tcp=54 topuser=madalice 2026-09-02 03:34:11 L1=1.36 run=4 blk=0 avail=6907 (50.1%) swpO=0 conn=1 myRSS=3330 php=6 phpRSS=595 ap=78 tcp=57 topuser=alison 2026-09-02 03:34:11 L1=1.36 run=2 blk=0 avail=7108 (51.6%) swpO=0 conn=2 myRSS=3330 php=4 phpRSS=331 ap=78 tcp=50 topuser=madalice 2026-09-02 03:34:21 L1=1.39 run=5 blk=0 avail=7121 (51.7%) swpO=3 conn=1 myRSS=3330 php=6 phpRSS=452 ap=68 tcp=52 topuser=madalice 2026-09-02 03:34:21 L1=1.39 run=3 blk=0 avail=7236 (52.5%) swpO=3 conn=2 myRSS=3330 php=5 phpRSS=354 ap=68 tcp=57 topuser=madalice 2026-09-02 03:34:31 L1=1.62 run=4 blk=0 avail=7278 (52.8%) swpO=1 conn=1 myRSS=3330 php=5 phpRSS=372 ap=60 tcp=51 topuser=alison 2026-09-02 03:34:31 L1=1.62 run=4 blk=0 avail=7196 (52.2%) swpO=1 conn=2 myRSS=3330 php=5 phpRSS=436 ap=60 tcp=51 topuser=alison 2026-09-02 03:34:41 L1=1.74 run=3 blk=0 avail=7203 (52.3%) swpO=0 conn=1 myRSS=3330 php=3 phpRSS=194 ap=86 tcp=58 topuser=madalice 2026-09-02 03:34:41 L1=1.68 run=1 blk=0 avail=7195 (52.2%) swpO=0 conn=2 myRSS=3330 php=3 phpRSS=194 ap=86 tcp=52 topuser=madalice 2026-09-02 03:34:51 L1=1.87 run=4 blk=0 avail=6971 (50.6%) swpO=0 conn=1 myRSS=3330 php=6 phpRSS=557 ap=76 tcp=59 topuser=alison 2026-09-02 03:34:51 L1=1.96 run=6 blk=0 avail=7032 (51.0%) swpO=0 conn=2 myRSS=3330 php=6 phpRSS=515 ap=76 tcp=56 topuser=evolution 2026-09-02 03:35:01 L1=1.96 run=4 blk=0 avail=7028 (51.0%) swpO=0 conn=1 myRSS=3330 php=6 phpRSS=451 ap=68 tcp=58 topuser=alison 2026-09-02 03:35:01 L1=2.05 run=18 blk=0 avail=7153 (51.9%) swpO=0 conn=3 myRSS=3330 php=5 phpRSS=409 ap=68 tcp=60 topuser=alison 2026-09-02 03:35:11 L1=1.96 run=6 blk=0 avail=7362 (53.4%) swpO=0 conn=1 myRSS=3330 php=3 phpRSS=194 ap=59 tcp=57 topuser=madalice 2026-09-02 03:35:11 L1=1.88 run=3 blk=0 avail=7362 (53.4%) swpO=0 conn=3 myRSS=3330 php=3 phpRSS=194 ap=59 tcp=66 topuser=madalice 2026-09-02 03:35:21 L1=2.13 run=5 blk=0 avail=7191 (52.2%) swpO=0 conn=1 myRSS=3330 php=7 phpRSS=523 ap=53 tcp=60 topuser=alison 2026-09-02 03:35:21 L1=2.28 run=5 blk=0 avail=7046 (51.1%) swpO=0 conn=3 myRSS=3330 php=7 phpRSS=687 ap=52 tcp=61 topuser=alison 2026-09-02 03:35:31 L1=2.34 run=10 blk=0 avail=6954 (50.5%) swpO=0 conn=1 myRSS=3330 php=8 phpRSS=621 ap=61 tcp=81 topuser=alison 2026-09-02 03:35:31 L1=3.04 run=4 blk=0 avail=7133 (51.8%) swpO=0 conn=3 myRSS=3330 php=5 phpRSS=475 ap=61 tcp=81 topuser=evolution 2026-09-02 03:35:41 L1=2.96 run=4 blk=0 avail=7182 (52.1%) swpO=3 conn=3 myRSS=3330 php=6 phpRSS=507 ap=53 tcp=61 topuser=madalice 2026-09-02 03:35:41 L1=2.96 run=5 blk=0 avail=7091 (51.5%) swpO=3 conn=3 myRSS=3330 php=7 phpRSS=635 ap=52 tcp=61 topuser=madalice 2026-09-02 03:35:51 L1=2.65 run=4 blk=0 avail=7301 (53.0%) swpO=1 conn=3 myRSS=3330 php=5 phpRSS=421 ap=45 tcp=51 topuser=madalice 2026-09-02 03:35:51 L1=2.65 run=3 blk=0 avail=7211 (52.3%) swpO=1 conn=3 myRSS=3330 php=7 phpRSS=563 ap=45 tcp=61 topuser=madalice 2026-09-02 03:36:01 L1=2.86 run=7 blk=0 avail=6512 (47.3%) swpO=104 conn=3 myRSS=3328 php=11 phpRSS=1085 ap=82 tcp=94 topuser=evolution 2026-09-02 03:36:02 L1=2.86 run=6 blk=0 avail=6254 (45.4%) swpO=95 conn=6 myRSS=3328 php=10 phpRSS=1253 ap=90 tcp=105 topuser=evolution 2026-09-02 03:36:11 L1=3.36 run=7 blk=0 avail=6311 (45.8%) swpO=62 conn=3 myRSS=3327 php=8 phpRSS=812 ap=134 tcp=103 topuser=madalice 2026-09-02 03:36:12 L1=3.36 run=4 blk=0 avail=6431 (46.7%) swpO=62 conn=6 myRSS=3327 php=7 phpRSS=638 ap=134 tcp=101 topuser=madalice 2026-09-02 03:36:21 L1=4.32 run=11 blk=0 avail=5501 (39.9%) swpO=115 conn=6 myRSS=3326 php=13 phpRSS=1649 ap=146 tcp=121 topuser=madalice 2026-09-02 03:36:22 L1=4.32 run=9 blk=1 avail=5821 (42.3%) swpO=464 conn=6 myRSS=3320 php=9 phpRSS=1189 ap=148 tcp=111 topuser=madalice