INCIDENT 2026-09-03 10:23:01 trigger: php_rss=1575MB ================================================================== load: 1.22 1.80 2.14 7/771 3269604 ncpu:10 mem_avail: 6822MB/13777MB (49.5%) swap_used:1395MB swapout:0/s blocked(D):0 running:8 iowait:0.1% steal:0.0% php: 15 procs / 1575MB heaviest user: madalice (8 procs, 1259MB) apache: 103 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2803 nobody 102 1683 madalice 8 1261 root 245 897 netdata 8 275 evolution 14 228 wp-toolkit 3 113 alison 2 83 mailnull 6 44 dovenull 6 28 mailman 20 26 polkitd 1 20 cpanellogin 1 20 zabbix 1 12 candyfabcom 1 12 lowrange 1 11 named 1 7 dovecot 3 6 nscd 1 4 kurri 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1261 evolution 5 214 alison 1 72 root 1 33 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5886 MB Active(file): 4561 MB Inactive(file): 1524 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 540 MB CommitLimit: 10984 MB Committed_AS: 10296 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 2-08:00:33 4992 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 2870608 12.5 Ssl 20:08:48 /usr/sbin/mariadbd 1596047 1543747 root 197228 0.1 S 07:45:13 spamd child 1542443 1 netdata 181528 2.5 Ssl 08:00:38 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3268742 1542510 madalice 162844 7.1 S 00:52 php-fpm: pool madalice_com_au 3268726 1542510 madalice 160984 9.2 S 00:53 php-fpm: pool madalice_com_au 3268736 1542510 madalice 159692 6.9 S 00:52 php-fpm: pool madalice_com_au 3268724 1542510 madalice 159448 10.0 S 00:53 php-fpm: pool madalice_com_au 3268725 1542510 madalice 156572 7.0 S 00:53 php-fpm: pool madalice_com_au 3269517 1542510 madalice 131024 21.8 S 00:06 php-fpm: pool madalice_com_au 3269516 1542510 madalice 129288 22.0 S 00:06 php-fpm: pool madalice_com_au 3269519 1542510 madalice 126796 21.5 S 00:06 php-fpm: pool madalice_com_au 1543747 1 root 119824 0.0 Ss 08:00:08 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1596048 1543747 root 115900 0.0 S 07:45:13 spamd child 3269564 3268671 alison 79804 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542981 1542551 netdata 68228 0.1 Sl 08:00:34 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3269565 3268468 evolution 68036 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3269562 3268612 evolution 67276 13.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1542487 1 wp-toolkit 62060 0.0 Ss 08:00:38 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 54832 0.0 Sl 6-08:03:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1542531 1 wp-toolkit 44496 0.0 Ss 08:00:37 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3269567 3250156 evolution 43456 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 41892 0.1 Ss 43-07:41:45 cpsrvd (SSL) - waiting for connections 1542141 1 root 41472 0.0 Ss 08:00:41 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1469 1 root 38468 0.1 Ss 66-00:13:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542510 1 root 34612 0.0 Ss 08:00:37 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1542072 1 root 32076 0.0 Ss 08:00:42 lfd - sleeping 1542188 1 root 28680 0.1 Ssl 08:00:40 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 25024 0.0 Ss 66-00:13:14 tailwatchd 3250156 506832 nobody 21444 0.0 S 05:36 /usr/sbin/httpd -k start 1542555 1 polkitd 21140 0.0 Ssl 08:00:37 /usr/lib/polkit-1/polkitd --no-debug 3249606 506832 nobody 20784 0.0 S 06:11 /usr/sbin/httpd -k start 3192902 1353308 cpanellogin 20720 0.0 S 19:24 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 3249182 506832 nobody 20440 0.1 S 06:43 /usr/sbin/httpd -k start 3248288 506832 nobody 20276 0.0 S 07:47 /usr/sbin/httpd -k start 3252390 506832 nobody 19672 0.0 S 03:09 /usr/sbin/httpd -k start 3252626 506832 nobody 19436 0.0 S 02:59 /usr/sbin/httpd -k start 3252618 506832 nobody 19200 0.0 S 02:59 /usr/sbin/httpd -k start 3252387 506832 nobody 19196 0.0 S 03:09 /usr/sbin/httpd -k start 3268631 506832 nobody 19108 0.1 S 00:57 /usr/sbin/httpd -k start 3252373 506832 nobody 18892 0.1 S 03:10 /usr/sbin/httpd -k start 3252389 506832 nobody 18868 0.0 S 03:09 /usr/sbin/httpd -k start 3268671 506832 nobody 18664 0.0 S 00:56 /usr/sbin/httpd -k start 3268588 506832 nobody 18640 0.0 S 00:58 /usr/sbin/httpd -k start 3268683 506832 nobody 18620 0.0 S 00:56 /usr/sbin/httpd -k start 3268577 506832 nobody 18508 0.0 S 00:59 /usr/sbin/httpd -k start 3252092 506832 nobody 18476 0.0 S 03:29 /usr/sbin/httpd -k start 3268645 506832 nobody 18452 0.0 S 00:57 /usr/sbin/httpd -k start 3268615 506832 nobody 18432 0.0 S 00:58 /usr/sbin/httpd -k start 3252386 506832 nobody 18428 0.0 S 03:09 /usr/sbin/httpd -k start 3268469 506832 nobody 18396 0.0 S 01:01 /usr/sbin/httpd -k start 3268642 506832 nobody 18380 0.0 S 00:57 /usr/sbin/httpd -k start 3252623 506832 nobody 18368 0.0 S 02:59 /usr/sbin/httpd -k start 3268649 506832 nobody 18368 0.0 S 00:57 /usr/sbin/httpd -k start 3252915 506832 nobody 18364 0.0 S 02:58 /usr/sbin/httpd -k start 3268640 506832 nobody 18348 0.0 S 00:57 /usr/sbin/httpd -k start 3268626 506832 nobody 18344 0.0 S 00:57 /usr/sbin/httpd -k start 3268443 506832 nobody 18320 0.0 S 01:03 /usr/sbin/httpd -k start 3268669 506832 nobody 18320 0.0 S 00:56 /usr/sbin/httpd -k start 3268591 506832 nobody 18264 0.0 S 00:58 /usr/sbin/httpd -k start 3268581 506832 nobody 18208 0.0 S 00:59 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3463573 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3463572 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 3463442 | root | 108-1481181613 | Execute | 0 | Sending data | select inventory_discounts.* FROM inventory_discounts, quoteitems where quoteitems.contractid=inventory_discounts.contract_id and quoteitems.quoteid = ? | +---------+----------------------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 448 kurri/kurrimotorinn.com.au-ssl_log 220 evolution/portal.evolutionerp.com.au-ssl_log 155 aaa/aaadownunder.com.au-ssl_log 149 madalice/madalice.com.au-ssl_log 99 evolution/app.evolutionerp.com.au-ssl_log 96 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 269 203.54.180.238 220 34.32.24.95 180 103.104.165.99 127 195.178.110.103 96 40.115.94.245 74 20.104.49.130 52 103.104.164.114 39 124.168.5.234 30 180.181.236.49 16 2001:8004:14b3:854f:95d1:bdfe:1050:32b5 16 1.144.107.82 12 1.145.70.156 6 1.145.17.226 4 182.239.240.254 3 150.228.151.47 --- top request paths across all vhosts (last 3 min) --- 171 POST /functions.php 93 GET /app/ajax.php 57 GET /heartbeat.php 44 GET /factory_session_checker.php 40 GET /index.php 24 POST /plugins/csvexporter/plugin.php 23 GET /factory_session_processed_qty.php 23 GET /factory_session_joiner.php 21 POST /wp/ 20 POST /quoteditsave.php 19 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax.php 15 POST /wp/index.php 14 POST /app/ajax/selectFilter.php 10 POST /wp-admin/admin-ajax.php 9 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 171 POST /functions.php 93 GET /app/ajax.php 36 GET /index.php 24 POST /plugins/csvexporter/plugin.php 20 POST /quoteditsave.php 19 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax.php 14 POST /app/ajax/selectFilter.php 7 POST /plugins/fencecosting/plugin.php 6 POST /purchaseaddsave.php 6 POST /clienteditsave.php 5 POST /invoiceaddsave.php -- last 10 requests -- 103.104.165.99 - - [03/Sep/2026:10:22:56 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dstaffedit%26id%3D84&call=getUserSetting&caller=ajaxSubmitLocal&seq=19823751654 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ 103.104.165.99 - - [03/Sep/2026:10:22:57 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dstaffedit%26id%3D84&call=getUserSetting&caller=ajaxSubmitLocal&seq=17301149172 HTTP/1.1" 200 97 "https://my.evolutionerp.com.au/ 150.228.151.47 - - [03/Sep/2026:10:22:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [03/Sep/2026:10:22:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=34055" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 103.104.165.99 - - [03/Sep/2026:10:22:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=staffedit&id=84" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 103.104.165.99 - - [03/Sep/2026:10:22:58 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 5909 "https://my.evolutionerp.com.au/index.php?page=staffedit&id=84" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 103.104.164.114 - - [03/Sep/2026:10:22:58 +1000] "POST /invoiceaddsave.php?save=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4862%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=4862&t 103.104.164.114 - - [03/Sep/2026:10:22:59 +1000] "GET /index.php?page=invoiceadd&invoiceid=4862 HTTP/1.1" 200 54317 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4862%2Findex.php%3Fpage%3Dinvoiceadd 103.104.164.114 - - [03/Sep/2026:10:22:59 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13452655715 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 103.104.164.114 - - [03/Sep/2026:10:22:59 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15438588587 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/ind == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /var/www/html/.env -- last 10 requests -- 34.32.24.95 - - [03/Sep/2026:10:22:55 +1000] "GET /config/app/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:56 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:56 +1000] "GET /info.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:56 +1000] "GET /php.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:56 +1000] "GET /i.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:57 +1000] "GET /pi.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:57 +1000] "GET /pinfo.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:57 +1000] "GET /test.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:57 +1000] "GET /phpinfo HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.24.95 - - [03/Sep/2026:10:22:58 +1000] "GET /p.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 57 GET /heartbeat.php 44 GET /factory_session_checker.php 23 GET /factory_session_processed_qty.php 23 GET /factory_session_joiner.php 3 GET /index.php 2 POST /portal/register 1 POST /inventory.php 1 POST /factory_functions.php 1 GET /uploadsave.php -- last 10 requests -- 203.54.180.238 - - [03/Sep/2026:10:22:47 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [03/Sep/2026:10:22:47 +1000] "GET /factory_session_joiner.php?id=35083 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [03/Sep/2026:10:22:48 +1000] "GET /heartbeat.php?sentAt=1788394966&bytes=106,152,189,214&_=1788387673451 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [03/Sep/2026:10:22:49 +1000] "GET /heartbeat.php?sentAt=1788394970&bytes=106,152,189,218&_=1788392175345 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [03/Sep/2026:10:22:51 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [03/Sep/2026:10:22:50 +1000] "GET /heartbeat.php?sentAt=1788394970&bytes=106,152,189,218&_=1788394470440 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 203.54.180.238 - - [03/Sep/2026:10:22:51 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [03/Sep/2026:10:22:53 +1000] "GET /factory_session_joiner.php?id=35084 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [03/Sep/2026:10:22:53 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [03/Sep/2026:10:22:53 +1000] "GET /heartbeat.php?sentAt=1788394973&bytes=106,152,189,221&_=1788349195063 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-09-03 10:20:40 L1=2.05 run=1 blk=0 avail=7958 (57.8%) swpO=0 conn=3 myRSS=2836 php=6 phpRSS=426 ap=62 tcp=61 topuser=madalice 2026-09-03 10:20:40 L1=2.05 run=3 blk=0 avail=7957 (57.8%) swpO=0 conn=1 myRSS=2836 php=6 phpRSS=426 ap=62 tcp=61 topuser=madalice 2026-09-03 10:20:50 L1=2.04 run=2 blk=0 avail=8034 (58.3%) swpO=0 conn=3 myRSS=2836 php=6 phpRSS=427 ap=53 tcp=64 topuser=madalice 2026-09-03 10:20:50 L1=2.04 run=4 blk=0 avail=8033 (58.3%) swpO=0 conn=1 myRSS=2836 php=6 phpRSS=427 ap=53 tcp=64 topuser=madalice 2026-09-03 10:21:00 L1=1.72 run=4 blk=0 avail=8068 (58.6%) swpO=0 conn=3 myRSS=2803 php=8 phpRSS=536 ap=50 tcp=50 topuser=madalice 2026-09-03 10:21:00 L1=1.72 run=5 blk=0 avail=8067 (58.6%) swpO=0 conn=4 myRSS=2803 php=8 phpRSS=536 ap=50 tcp=50 topuser=madalice 2026-09-03 10:21:10 L1=1.54 run=3 blk=1 avail=8036 (58.3%) swpO=0 conn=5 myRSS=2804 php=6 phpRSS=545 ap=44 tcp=58 topuser=corpkicks 2026-09-03 10:21:10 L1=1.54 run=5 blk=0 avail=8043 (58.4%) swpO=0 conn=4 myRSS=2804 php=6 phpRSS=548 ap=44 tcp=58 topuser=corpkicks 2026-09-03 10:21:20 L1=1.67 run=3 blk=0 avail=8310 (60.3%) swpO=0 conn=5 myRSS=2804 php=5 phpRSS=270 ap=43 tcp=42 topuser=madalice 2026-09-03 10:21:20 L1=1.67 run=2 blk=0 avail=8310 (60.3%) swpO=0 conn=4 myRSS=2804 php=5 phpRSS=270 ap=43 tcp=42 topuser=madalice 2026-09-03 10:21:30 L1=1.64 run=2 blk=0 avail=8308 (60.3%) swpO=0 conn=5 myRSS=2798 php=5 phpRSS=271 ap=43 tcp=54 topuser=madalice 2026-09-03 10:21:30 L1=1.64 run=2 blk=0 avail=8308 (60.3%) swpO=0 conn=4 myRSS=2798 php=5 phpRSS=271 ap=43 tcp=54 topuser=madalice 2026-09-03 10:21:40 L1=1.62 run=3 blk=0 avail=8306 (60.3%) swpO=0 conn=5 myRSS=2798 php=6 phpRSS=337 ap=39 tcp=39 topuser=madalice 2026-09-03 10:21:40 L1=1.62 run=3 blk=0 avail=8306 (60.3%) swpO=0 conn=4 myRSS=2798 php=6 phpRSS=337 ap=39 tcp=39 topuser=madalice 2026-09-03 10:21:50 L1=1.45 run=3 blk=0 avail=8132 (59.0%) swpO=0 conn=5 myRSS=2798 php=8 phpRSS=619 ap=32 tcp=37 topuser=madalice 2026-09-03 10:21:50 L1=1.45 run=3 blk=0 avail=8132 (59.0%) swpO=0 conn=4 myRSS=2798 php=8 phpRSS=619 ap=32 tcp=37 topuser=madalice 2026-09-03 10:22:00 L1=1.62 run=3 blk=0 avail=8215 (59.6%) swpO=0 conn=5 myRSS=2799 php=5 phpRSS=392 ap=40 tcp=146 topuser=madalice 2026-09-03 10:22:00 L1=1.62 run=3 blk=0 avail=8214 (59.6%) swpO=0 conn=3 myRSS=2799 php=5 phpRSS=392 ap=40 tcp=146 topuser=madalice 2026-09-03 10:22:11 L1=1.52 run=5 blk=0 avail=6571 (47.7%) swpO=669 conn=7 myRSS=2796 php=13 phpRSS=1433 ap=153 tcp=122 topuser=madalice 2026-09-03 10:22:11 L1=1.52 run=6 blk=0 avail=6556 (47.6%) swpO=669 conn=3 myRSS=2796 php=13 phpRSS=1436 ap=153 tcp=122 topuser=madalice 2026-09-03 10:22:21 L1=1.52 run=3 blk=0 avail=6712 (48.7%) swpO=0 conn=7 myRSS=2796 php=12 phpRSS=1331 ap=143 tcp=56 topuser=madalice 2026-09-03 10:22:21 L1=1.52 run=5 blk=0 avail=6704 (48.7%) swpO=0 conn=3 myRSS=2796 php=13 phpRSS=1373 ap=143 tcp=56 topuser=madalice 2026-09-03 10:22:31 L1=1.28 run=4 blk=0 avail=6796 (49.3%) swpO=0 conn=7 myRSS=2802 php=12 phpRSS=1276 ap=133 tcp=56 topuser=madalice 2026-09-03 10:22:31 L1=1.28 run=5 blk=0 avail=6808 (49.4%) swpO=0 conn=3 myRSS=2802 php=12 phpRSS=1276 ap=133 tcp=56 topuser=madalice 2026-09-03 10:22:41 L1=1.31 run=2 blk=0 avail=7130 (51.8%) swpO=0 conn=7 myRSS=2803 php=9 phpRSS=973 ap=123 tcp=55 topuser=madalice 2026-09-03 10:22:41 L1=1.31 run=4 blk=0 avail=7130 (51.8%) swpO=0 conn=3 myRSS=2803 php=9 phpRSS=973 ap=123 tcp=55 topuser=madalice 2026-09-03 10:22:51 L1=1.18 run=4 blk=0 avail=7062 (51.3%) swpO=0 conn=7 myRSS=2803 php=10 phpRSS=1158 ap=113 tcp=56 topuser=madalice 2026-09-03 10:22:51 L1=1.18 run=5 blk=0 avail=7058 (51.2%) swpO=0 conn=3 myRSS=2803 php=10 phpRSS=1153 ap=113 tcp=55 topuser=madalice 2026-09-03 10:23:01 L1=1.22 run=8 blk=0 avail=6822 (49.5%) swpO=0 conn=7 myRSS=2803 php=15 phpRSS=1575 ap=103 tcp=62 topuser=madalice 2026-09-03 10:23:01 L1=1.22 run=8 blk=0 avail=6815 (49.5%) swpO=0 conn=6 myRSS=2803 php=15 phpRSS=1581 ap=103 tcp=60 topuser=madalice