INCIDENT 2026-09-02 14:50:02 trigger: php_rss=1663MB ================================================================== load: 2.87 2.11 3.29 2/664 3370165 ncpu:10 mem_avail: 8303MB/13777MB (60.3%) swap_used:1375MB swapout:0/s blocked(D):1 running:2 iowait:0.1% steal:0.0% php: 12 procs / 1663MB heaviest user: madalice (10 procs, 1660MB) apache: 73 procs tcp_estab: 60 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1889 madalice 10 1660 nobody 72 1080 root 251 457 netdata 7 197 evolution 10 95 cpanellogin 1 47 mailman 20 36 mailnull 4 29 dovenull 6 19 wp-toolkit 3 18 zabbix 1 17 candyfabcom 1 12 aaa 1 12 lowrange 1 11 dovecot 3 9 kurri 1 4 polkitd 1 3 nscd 1 3 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1660 root 1 2 evolution 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5644 MB Active(file): 4127 MB Inactive(file): 1890 MB Dirty: 129 MB Writeback: 0 MB SReclaimable: 281 MB CommitLimit: 10984 MB Committed_AS: 9266 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3370028 root 00:01 1252 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 1-12:27:34 4596 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 1934444 37.1 Ssl 35:49 /usr/sbin/mariadbd 3369920 3929444 madalice 254952 30.3 S 00:09 php-fpm: pool madalice_com_au 508924 1 netdata 182196 2.0 Ssl 5-12:30:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3292380 3929444 madalice 164936 10.7 S 22:45 php-fpm: pool madalice_com_au 3367548 3929444 madalice 163616 23.5 S 03:23 php-fpm: pool madalice_com_au 3369272 3929444 madalice 163508 30.0 S 01:03 php-fpm: pool madalice_com_au 3369922 3929444 madalice 163340 28.1 S 00:09 php-fpm: pool madalice_com_au 3369925 3929444 madalice 163184 29.8 S 00:09 php-fpm: pool madalice_com_au 3369926 3929444 madalice 162924 30.2 S 00:09 php-fpm: pool madalice_com_au 3369924 3929444 madalice 162312 28.8 S 00:09 php-fpm: pool madalice_com_au 3369923 3929444 madalice 161480 27.2 S 00:09 php-fpm: pool madalice_com_au 706071 655564 root 152800 0.0 S 12:12:04 spamd child 3369921 3929444 madalice 140380 15.1 S 00:09 php-fpm: pool madalice_com_au 3370119 3370060 evolution 99420 66.0 R 00:01 git reset --hard origin/staging 3239542 1353308 cpanellogin 48948 0.0 S 35:35 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 3370174 3370001 alison 46660 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2900038 655564 root 43520 0.0 S 02:08:00 spamd child 1353308 1 root 42036 0.1 Ss 42-12:08:46 cpsrvd (SSL) - waiting for connections 509236 509098 root 27080 0.0 Sl 5-12:30:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3367325 506832 nobody 22120 0.0 S 03:48 /usr/sbin/httpd -k start 3368090 506832 nobody 22072 0.0 S 02:37 /usr/sbin/httpd -k start 3351863 506832 nobody 21952 0.0 S 05:09 /usr/sbin/httpd -k start 3350957 506832 nobody 21736 0.0 S 06:03 /usr/sbin/httpd -k start 3367130 506832 nobody 21500 0.0 S 04:04 /usr/sbin/httpd -k start 3368444 506832 nobody 20848 0.0 S 02:03 /usr/sbin/httpd -k start 3368104 506832 nobody 20336 0.0 S 02:35 /usr/sbin/httpd -k start 3368432 506832 nobody 20036 0.0 S 02:03 /usr/sbin/httpd -k start 3367451 506832 nobody 19824 0.0 S 03:35 /usr/sbin/httpd -k start 3368415 506832 nobody 19716 0.0 S 02:05 /usr/sbin/httpd -k start 3368965 506832 nobody 19448 0.1 S 01:37 /usr/sbin/httpd -k start 3368213 506832 nobody 19380 0.0 S 02:28 /usr/sbin/httpd -k start 3368951 506832 nobody 19324 0.0 S 01:38 /usr/sbin/httpd -k start 3368416 506832 nobody 18960 0.0 S 02:05 /usr/sbin/httpd -k start 3369251 506832 nobody 18952 0.0 S 01:08 /usr/sbin/httpd -k start 3369728 506832 nobody 18912 0.1 S 00:20 /usr/sbin/httpd -k start 3368968 506832 nobody 18820 0.0 S 01:37 /usr/sbin/httpd -k start 3369243 506832 nobody 18592 0.1 S 01:09 /usr/sbin/httpd -k start 3367440 506832 nobody 18512 0.0 S 03:36 /usr/sbin/httpd -k start 3369400 506832 nobody 18456 0.0 S 00:50 /usr/sbin/httpd -k start 3369244 506832 nobody 18452 0.0 S 01:09 /usr/sbin/httpd -k start 3369476 506832 nobody 18380 0.0 S 00:48 /usr/sbin/httpd -k start 3368097 506832 nobody 18376 0.0 S 02:36 /usr/sbin/httpd -k start 3370082 3370080 root 18264 2.0 S 00:01 /usr/local/cpanel/bin/dcpumon 3369165 506832 nobody 18140 0.0 S 01:13 /usr/sbin/httpd -k start 509671 508992 netdata 18068 2.1 Sl 5-12:30:18 /usr/libexec/netdata/plugins.d/apps.plugin 1 3369474 506832 nobody 18064 0.0 S 00:48 /usr/sbin/httpd -k start 3369712 506832 nobody 18052 0.0 S 00:21 /usr/sbin/httpd -k start 3369713 506832 nobody 18004 0.0 S 00:21 /usr/sbin/httpd -k start 483898 1 zabbix 17836 0.2 Ssl 5-12:31:37 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3369469 506832 nobody 17772 0.3 S 00:49 /usr/sbin/httpd -k start 3369682 506832 nobody 17772 0.0 S 00:23 /usr/sbin/httpd -k start 3369723 506832 nobody 17644 0.1 S 00:20 /usr/sbin/httpd -k start 3369715 506832 nobody 17500 0.0 S 00:21 /usr/sbin/httpd -k start 3369694 506832 nobody 17464 0.0 S 00:22 /usr/sbin/httpd -k start 3369981 506832 nobody 17324 0.3 S 00:03 /usr/sbin/httpd -k start 3369468 506832 nobody 16764 0.0 S 00:49 /usr/sbin/httpd -k start 3369979 506832 nobody 16252 0.0 S 00:03 /usr/sbin/httpd -k start 3369725 506832 nobody 16104 0.0 S 00:20 /usr/sbin/httpd -k start 3369729 506832 nobody 15956 0.1 S 00:20 /usr/sbin/httpd -k start 3369727 506832 nobody 15936 0.1 S 00:20 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 298870 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 372 kurri/kurrimotorinn.com.au-ssl_log 257 evolution/app.evolutionerp.com.au-ssl_log 118 evolution/portal.evolutionerp.com.au-ssl_log 92 madalice/madalice.com.au-ssl_log 91 aaa/aaadownunder.com.au-ssl_log 13 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 257 34.92.80.41 176 203.54.180.238 118 40.115.94.245 65 20.48.251.3 57 120.154.88.130 51 103.104.165.99 40 165.225.233.87 29 103.104.164.114 27 118.127.40.55 27 101.182.108.127 17 150.228.151.47 14 182.239.240.254 11 2001:8004:14b3:854f:95d1:bdfe:1050:32b5 10 1.144.107.82 6 34.178.44.22 --- top request paths across all vhosts (last 3 min) --- 135 POST /functions.php 62 GET /app/ajax.php 34 GET /heartbeat.php 26 GET /index.php 24 GET /factory_session_checker.php 18 POST /app/ajax/selectFilter.php 15 POST /plugins/csvexporter/plugin.php 13 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713410864.html 13 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713397831.html 12 POST /wp-admin/admin-ajax.php 12 GET /factory_session_joiner.php 11 GET /factory_session_processed_qty.php 10 POST /quoteditsave.php 10 POST /clienteditsave.php 10 POST /app/ajax.php 9 POST /plugins/fencecosting/plugin.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /jobeditsave.php 8 POST / 6 POST /itemModify.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 135 POST /functions.php 62 GET /app/ajax.php 23 GET /index.php 18 POST /app/ajax/selectFilter.php 15 POST /plugins/csvexporter/plugin.php 13 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713410864.html 13 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713397831.html 10 POST /quoteditsave.php 10 POST /clienteditsave.php 10 POST /app/ajax.php 9 POST /plugins/fencecosting/plugin.php 9 POST /app/ajax/selectFilterSingle.php -- last 10 requests -- 103.104.165.99 - - [02/Sep/2026:14:49:59 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 21932 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12115" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 120.154.88.130 - - [02/Sep/2026:14:50:01 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37041§ionid=32914" "Mozilla/5.0 (Windows NT 10.0; 120.154.88.130 - - [02/Sep/2026:14:50:01 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37041§ionid=32914" "Mozilla/5.0 (Windows NT 10 103.104.165.99 - - [02/Sep/2026:14:50:01 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12115&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 203.54.180.238 - - [02/Sep/2026:14:50:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79037§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 120.154.88.130 - - [02/Sep/2026:14:50:01 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37041§ionid=32914" "Mozilla/5.0 (Windows NT 10.0 120.154.88.130 - - [02/Sep/2026:14:50:01 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13974315009 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 120.154.88.130 - - [02/Sep/2026:14:50:01 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid37041&call=getUserSetting&caller=ajaxSubmitLocal&seq=18958870223 HTTP/1.1" 200 100 "https://my.evolutionerp.co 120.154.88.130 - - [02/Sep/2026:14:50:01 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17978833261 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 120.154.88.130 - - [02/Sep/2026:14:50:01 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D37041%26sectionid%3D32914&call=getUserSetting&caller=ajaxSubmitLocal&seq=12094638043 HTTP == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env 1 GET /vue/.env -- last 10 requests -- 34.92.80.41 - - [02/Sep/2026:14:49:44 +1000] "GET /staging/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:44 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:44 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG3030208 2 GET /api/getItem/SHSG125125508 2 GET /api/getItem/SHSG125125408 2 GET /api/getItem/SHSG10010050 2 GET /api/getItem/SHSG10010040 -- last 10 requests -- 40.115.94.245 - - [02/Sep/2026:14:49:43 +1000] "GET /api/getItem/RHSG5025308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:44 +1000] "GET /api/getItem/RHSG6535168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:44 +1000] "GET /api/getItem/RHSG6535208 HTTP/1.1" 200 1344 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:45 +1000] "GET /api/getItem/RHSG6535258 HTTP/1.1" 200 1168 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:45 +1000] "GET /api/getItem/RHSG6535308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:45 +1000] "GET /api/getItem/RHSG6535408 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:46 +1000] "GET /api/getItem/RHSG7525168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:46 +1000] "GET /api/getItem/RHSG7525208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:46 +1000] "GET /api/getItem/RHSG7525258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:14:49:47 +1000] "GET /api/getItem/RHSG7550168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-02 14:47:41 L1=2.29 run=4 blk=0 avail=9548 (69.3%) swpO=0 conn=2 myRSS=1884 php=6 phpRSS=428 ap=43 tcp=45 topuser=madalice 2026-09-02 14:47:42 L1=2.29 run=4 blk=0 avail=9554 (69.4%) swpO=0 conn=2 myRSS=1884 php=6 phpRSS=428 ap=43 tcp=44 topuser=madalice 2026-09-02 14:47:51 L1=2.33 run=3 blk=1 avail=9530 (69.2%) swpO=0 conn=2 myRSS=1884 php=7 phpRSS=543 ap=34 tcp=42 topuser=madalice 2026-09-02 14:47:52 L1=2.33 run=3 blk=0 avail=9493 (68.9%) swpO=0 conn=2 myRSS=1884 php=7 phpRSS=585 ap=33 tcp=43 topuser=madalice 2026-09-02 14:48:02 L1=2.44 run=2 blk=0 avail=9428 (68.4%) swpO=0 conn=2 myRSS=1884 php=6 phpRSS=429 ap=64 tcp=53 topuser=madalice 2026-09-02 14:48:02 L1=2.44 run=6 blk=0 avail=9434 (68.5%) swpO=0 conn=2 myRSS=1884 php=6 phpRSS=429 ap=63 tcp=54 topuser=madalice 2026-09-02 14:48:12 L1=2.37 run=2 blk=0 avail=9468 (68.7%) swpO=0 conn=2 myRSS=1884 php=7 phpRSS=470 ap=54 tcp=64 topuser=madalice 2026-09-02 14:48:12 L1=2.37 run=2 blk=0 avail=9475 (68.8%) swpO=0 conn=2 myRSS=1884 php=7 phpRSS=470 ap=53 tcp=63 topuser=madalice 2026-09-02 14:48:22 L1=2.40 run=6 blk=0 avail=9419 (68.4%) swpO=0 conn=2 myRSS=1885 php=10 phpRSS=653 ap=46 tcp=57 topuser=madalice 2026-09-02 14:48:22 L1=2.40 run=6 blk=0 avail=9416 (68.3%) swpO=0 conn=2 myRSS=1885 php=9 phpRSS=624 ap=45 tcp=57 topuser=madalice 2026-09-02 14:48:32 L1=2.34 run=6 blk=0 avail=9372 (68.0%) swpO=0 conn=2 myRSS=1885 php=10 phpRSS=634 ap=57 tcp=42 topuser=madalice 2026-09-02 14:48:32 L1=2.34 run=3 blk=0 avail=9429 (68.4%) swpO=0 conn=2 myRSS=1885 php=8 phpRSS=525 ap=56 tcp=43 topuser=madalice 2026-09-02 14:48:42 L1=2.51 run=3 blk=0 avail=9590 (69.6%) swpO=0 conn=2 myRSS=1885 php=4 phpRSS=326 ap=47 tcp=44 topuser=madalice 2026-09-02 14:48:42 L1=2.51 run=2 blk=0 avail=9596 (69.7%) swpO=0 conn=2 myRSS=1885 php=4 phpRSS=328 ap=46 tcp=40 topuser=madalice 2026-09-02 14:48:52 L1=2.36 run=4 blk=0 avail=9587 (69.6%) swpO=0 conn=2 myRSS=1885 php=6 phpRSS=399 ap=45 tcp=58 topuser=madalice 2026-09-02 14:48:52 L1=2.36 run=3 blk=0 avail=9561 (69.4%) swpO=0 conn=2 myRSS=1885 php=5 phpRSS=391 ap=45 tcp=58 topuser=madalice 2026-09-02 14:49:02 L1=2.31 run=3 blk=0 avail=9293 (67.5%) swpO=0 conn=3 myRSS=1886 php=6 phpRSS=681 ap=46 tcp=38 topuser=madalice 2026-09-02 14:49:02 L1=2.31 run=1 blk=0 avail=9372 (68.0%) swpO=0 conn=2 myRSS=1886 php=5 phpRSS=562 ap=46 tcp=38 topuser=madalice 2026-09-02 14:49:12 L1=2.35 run=4 blk=0 avail=9466 (68.7%) swpO=0 conn=3 myRSS=1886 php=7 phpRSS=584 ap=38 tcp=47 topuser=madalice 2026-09-02 14:49:12 L1=2.35 run=3 blk=0 avail=9441 (68.5%) swpO=0 conn=2 myRSS=1886 php=6 phpRSS=566 ap=38 tcp=50 topuser=madalice 2026-09-02 14:49:22 L1=2.21 run=1 blk=0 avail=9494 (68.9%) swpO=0 conn=3 myRSS=1886 php=5 phpRSS=481 ap=41 tcp=41 topuser=madalice 2026-09-02 14:49:22 L1=2.21 run=5 blk=0 avail=9492 (68.9%) swpO=0 conn=2 myRSS=1886 php=5 phpRSS=481 ap=41 tcp=41 topuser=madalice 2026-09-02 14:49:32 L1=2.09 run=4 blk=0 avail=9544 (69.3%) swpO=0 conn=3 myRSS=1886 php=6 phpRSS=523 ap=33 tcp=39 topuser=madalice 2026-09-02 14:49:32 L1=2.09 run=4 blk=0 avail=9547 (69.3%) swpO=0 conn=2 myRSS=1886 php=5 phpRSS=484 ap=33 tcp=39 topuser=madalice 2026-09-02 14:49:42 L1=2.08 run=5 blk=0 avail=9401 (68.2%) swpO=0 conn=3 myRSS=1887 php=6 phpRSS=553 ap=48 tcp=51 topuser=madalice 2026-09-02 14:49:42 L1=2.08 run=4 blk=0 avail=9383 (68.1%) swpO=0 conn=2 myRSS=1887 php=7 phpRSS=575 ap=48 tcp=52 topuser=madalice 2026-09-02 14:49:52 L1=1.99 run=2 blk=0 avail=9395 (68.2%) swpO=0 conn=3 myRSS=1887 php=5 phpRSS=555 ap=44 tcp=47 topuser=madalice 2026-09-02 14:49:52 L1=1.99 run=5 blk=0 avail=9354 (67.9%) swpO=0 conn=2 myRSS=1887 php=6 phpRSS=544 ap=44 tcp=47 topuser=madalice 2026-09-02 14:50:02 L1=2.87 run=2 blk=1 avail=8303 (60.3%) swpO=0 conn=2 myRSS=1889 php=12 phpRSS=1663 ap=73 tcp=60 topuser=madalice 2026-09-02 14:50:02 L1=2.87 run=9 blk=0 avail=8270 (60.0%) swpO=0 conn=3 myRSS=1889 php=13 phpRSS=1726 ap=73 tcp=57 topuser=madalice