INCIDENT 2026-09-04 21:51:59 trigger: php_rss=1979MB ================================================================== load: 2.45 0.87 0.64 9/680 2696545 ncpu:10 mem_avail: 6036MB/13777MB (43.8%) swap_used:1531MB swapout:0/s blocked(D):0 running:11 iowait:0.0% steal:0.0% php: 12 procs / 1979MB heaviest user: madalice (10 procs, 1947MB) apache: 28 procs tcp_estab: 54 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3421 madalice 10 1999 root 244 1040 nobody 27 449 netdata 8 255 dovenull 6 68 wp-toolkit 3 61 cpanellogin 1 58 dovecot 3 29 kurri 2 28 mailman 20 26 evolution 9 23 mailnull 3 13 zabbix 1 11 cpanelphpmyadmin 1 10 polkitd 1 7 named 1 5 nscd 1 4 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 2011 root 1 32 evolution 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5105 MB Active(file): 4254 MB Inactive(file): 1062 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 533 MB CommitLimit: 10984 MB Committed_AS: 8811 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 3-19:29:31 4176 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3503724 13.4 Ssl 2-07:37:47 /usr/sbin/mariadbd 2696088 2601907 madalice 253212 14.1 R 00:27 php-fpm: pool madalice_com_au 2696479 2601907 madalice 235032 42.6 R 00:03 php-fpm: pool madalice_com_au 2696482 2601907 madalice 233076 43.3 R 00:03 php-fpm: pool madalice_com_au 2696484 2601907 madalice 232856 42.0 R 00:03 php-fpm: pool madalice_com_au 2696480 2601907 madalice 227188 43.3 R 00:03 php-fpm: pool madalice_com_au 2696481 2601907 madalice 219540 41.6 R 00:03 php-fpm: pool madalice_com_au 2696483 2601907 madalice 209468 41.0 R 00:03 php-fpm: pool madalice_com_au 1043892 2603077 root 199280 0.1 S 07:47:03 spamd child 1542443 1 netdata 189388 2.6 Ssl 1-19:29:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2696493 2601907 madalice 165388 40.0 S 00:02 php-fpm: pool madalice_com_au 2696508 2601907 madalice 165376 42.5 S 00:02 php-fpm: pool madalice_com_au 2696507 2601907 madalice 165240 40.5 S 00:02 php-fpm: pool madalice_com_au 2654376 2603077 root 152524 0.0 S 19:12:52 spamd child 2603077 1 root 136776 0.0 Ss 19:27:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 135272 0.0 Ss 7-19:32:18 /usr/lib/systemd/systemd-journald 2507165 1353308 cpanellogin 59552 0.0 S 52:47 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 44060 0.0 Sl 7-19:32:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42296 0.1 Ss 44-19:10:44 cpsrvd (SSL) - waiting for connections 1469 1 root 41864 0.1 Ss 67-11:42:13 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542981 1542551 netdata 40900 0.1 Sl 1-19:29:33 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2696572 2696200 evolution 40844 4.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2696578 2680472 evolution 39232 4.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542487 1 wp-toolkit 34276 0.0 Ss 1-19:29:37 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 32964 0.0 Ss 19:28:33 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2602226 1 root 27540 0.1 Ssl 19:28:18 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 25912 0.0 Ss 67-11:42:13 tailwatchd 1542531 1 wp-toolkit 22216 0.0 Ss 1-19:29:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2680467 506832 nobody 21128 0.0 S 02:39 /usr/sbin/httpd -k start 2695542 506832 nobody 20780 0.0 S 01:17 /usr/sbin/httpd -k start 2680459 506832 nobody 20560 0.0 S 02:40 /usr/sbin/httpd -k start 2680503 506832 nobody 20440 0.0 S 02:38 /usr/sbin/httpd -k start 2680477 506832 nobody 20384 0.0 S 02:39 /usr/sbin/httpd -k start 2680473 506832 nobody 20048 0.0 S 02:39 /usr/sbin/httpd -k start 2680472 506832 nobody 19416 0.1 S 02:39 /usr/sbin/httpd -k start 2695574 506832 nobody 18956 0.0 S 01:12 /usr/sbin/httpd -k start 1542982 1542551 netdata 18244 2.1 Sl 1-19:29:33 /usr/libexec/netdata/plugins.d/apps.plugin 1 2696201 506832 nobody 18108 0.0 S 00:13 /usr/sbin/httpd -k start 2696488 506832 nobody 17720 0.0 S 00:03 /usr/sbin/httpd -k start 2696171 506832 nobody 17600 0.1 S 00:18 /usr/sbin/httpd -k start 2696202 506832 nobody 17480 0.0 S 00:13 /usr/sbin/httpd -k start 2696223 506832 nobody 17452 0.0 S 00:12 /usr/sbin/httpd -k start 2696190 506832 nobody 17388 0.0 S 00:14 /usr/sbin/httpd -k start 2696229 506832 nobody 17324 0.0 S 00:12 /usr/sbin/httpd -k start 690513 508511 root 17288 0.0 S 09:19:09 dovecot/config 2696179 506832 nobody 17256 0.0 S 00:17 /usr/sbin/httpd -k start 2696178 506832 nobody 17252 0.0 S 00:17 /usr/sbin/httpd -k start 2696189 506832 nobody 17248 0.0 S 00:14 /usr/sbin/httpd -k start 2696225 506832 nobody 17116 0.0 S 00:12 /usr/sbin/httpd -k start 1542141 1 root 17108 0.0 Ss 1-19:29:40 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 2696224 506832 nobody 17080 0.0 S 00:12 /usr/sbin/httpd -k start 2696203 506832 nobody 17040 0.0 S 00:13 /usr/sbin/httpd -k start 2696550 506832 nobody 16908 0.0 S 00:01 /usr/sbin/httpd -k start 2696505 506832 nobody 16860 0.0 S 00:02 /usr/sbin/httpd -k start 2696551 506832 nobody 16860 0.0 S 00:01 /usr/sbin/httpd -k start 2696553 506832 nobody 16860 0.0 S 00:01 /usr/sbin/httpd -k start 2696506 506832 nobody 16800 0.0 S 00:02 /usr/sbin/httpd -k start 2696552 506832 nobody 16800 0.0 S 00:01 /usr/sbin/httpd -k start 2696226 506832 nobody 16676 0.0 S 00:12 /usr/sbin/httpd -k start 2696200 506832 nobody 16444 0.5 S 00:13 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10502941 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10502840 | madalice_wp | madalice_wp | Query | 0 | Writing to net | select * from AMuqf6qZ_addonlibrary_addons as addons where addons.addontype in('elementor','bg_addon') and addons.is_active=1 | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 170 evolution/evolutionerp.com.au-ssl_log 79 coscom/coscom.com.au-ssl_log 29 customc/customcentral.com.au-ssl_log 28 candyfabcom/candyfab.com.au-ssl_log 27 corpkicks/corporatekicks.com.au-ssl_log 26 cosgrovecreative/cosgrovecreative.com.au-ssl_log 24 nrg/nrgservices.net.au-ssl_log 23 coscom/coscom.com.au 18 madalice/madalice.com.au-ssl_log 15 evolution/portal.evolutionerp.com.au-ssl_log 8 evolution/my.evolutionerp.com.au-ssl_log 7 tubesupplies/tubesupplies.com.au-ssl_log 2 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 170 40.115.94.245 105 45.148.10.125 74 93.123.109.228 38 185.104.184.228 8 203.54.180.238 7 8.234.157.146 5 118.127.40.55 4 114.119.143.14 3 82.135.202.97 3 52.167.144.188 3 34.88.109.145 2 43.165.67.31 2 40.77.167.132 2 114.119.159.70 2 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 55 GET /api/getItem/LWPG2001KG 29 GET /api/getItem/LWFB2001KG 16 GET / 8 GET /heartbeat.php 6 GET /.env.save 6 GET /.env.prod 5 GET /index.php 5 GET /.git/config 5 GET /.env.test 5 GET /.env.example 5 GET /.env.bak 5 GET /.env.backup 5 GET /.env 5 GET /.aws/credentials 5 GET /.aws/config 4 POST /wp-cron.php 4 GET /wp-config.php 4 GET /test.php 4 GET /.s3cfg 4 GET /phpinfo.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 55 GET /api/getItem/LWPG2001KG 29 GET /api/getItem/LWFB2001KG 2 GET /api/getItem/SHSG404016-8 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSG501009-7320 2 GET /api/getItem/19R-8000 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 -- last 10 requests -- 40.115.94.245 - - [04/Sep/2026:21:51:54 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:55 +1000] "GET /api/getItem/SHSG757550-8 HTTP/1.1" 200 1944 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:55 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:55 +1000] "GET /api/getItem/SHSG898920-8 HTTP/1.1" 200 1866 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:55 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:55 +1000] "GET /api/getItem/SHSG898930-8 HTTP/1.1" 200 1339 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:55 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:56 +1000] "GET /api/getItem/SHSG898935-8 HTTP/1.1" 200 1491 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:56 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:21:51:56 +1000] "GET /api/getItem/SHSG898950-8 HTTP/1.1" 200 1346 "-" "RestSharp/106.13.0.0" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 4 GET / 2 POST /wp-cron.php 1 GET /*update.cgi* 1 GET /*/[slug] 1 GET /*/[id] 1 GET /.git-secret 1 GET /.git/ORIG_HEAD 1 GET /.git/objects/pack 1 GET /.git/objects/info 1 GET /.git/logs/refs/remotes/origin/main 1 GET /.git/logs/refs/heads/master 1 GET /.git/logs/refs/heads/main -- last 10 requests -- 93.123.109.228 - - [04/Sep/2026:21:51:49 +1000] "GET /.git/hooks HTTP/1.1" 404 123950 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:21:51:49 +1000] "GET /.git/info/exclude HTTP/1.1" 404 119839 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:21:51:49 +1000] "GET /.git/hooks/post-commit HTTP/1.1" 404 119844 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [04/Sep/2026:21:51:49 +1000] "GET /.git/index HTTP/1.1" 404 123950 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [04/Sep/2026:21:51:49 +1000] "GET /.git/logs/refs/heads/main HTTP/1.1" 404 119849 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:21:51:50 +1000] "GET /.git/objects/info HTTP/1.1" 404 119839 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 93.123.109.228 - - [04/Sep/2026:21:51:50 +1000] "GET /.git/objects/pack HTTP/1.1" 404 119843 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [04/Sep/2026:21:51:50 +1000] "GET /.git/logs/HEAD HTTP/1.1" 404 119840 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0 93.123.109.228 - - [04/Sep/2026:21:51:50 +1000] "GET /.git/logs/refs/heads/master HTTP/1.1" 404 119853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:21:51:50 +1000] "GET /.git/logs/refs/remotes/origin/main HTTP/1.1" 404 119856 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 S == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /wp-config.php 1 GET /web.config 1 GET /.travis.yml 1 GET /test.php 1 GET /.s3cfg 1 GET /phpinfo.php 1 GET /info.php 1 GET /.htpasswd 1 GET /.git/HEAD 1 GET /.git/config 1 GET /.env.test 1 GET /.env.save -- last 10 requests -- 45.148.10.125 - - [04/Sep/2026:21:49:46 +1000] "GET /test.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:46 +1000] "GET /.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:47 +1000] "GET /.aws/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:47 +1000] "GET /aws-credentials HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:48 +1000] "GET /.s3cfg HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:49 +1000] "GET /web.config HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:50 +1000] "GET /.htpasswd HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:50 +1000] "GET /docker-compose.yml HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:50 +1000] "GET /.travis.yml HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 45.148.10.125 - - [04/Sep/2026:21:49:51 +1000] "GET /.git/HEAD HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" --- last 30 samples (run-up to this incident) --- 2026-09-04 21:49:38 L1=0.36 run=1 blk=0 avail=7356 (53.4%) swpO=0 conn=2 myRSS=3421 php=4 phpRSS=188 ap=61 tcp=33 topuser=madalice 2026-09-04 21:49:39 L1=0.36 run=1 blk=0 avail=7370 (53.5%) swpO=0 conn=2 myRSS=3421 php=3 phpRSS=188 ap=60 tcp=38 topuser=madalice 2026-09-04 21:49:48 L1=0.31 run=1 blk=0 avail=7561 (54.9%) swpO=0 conn=1 myRSS=3421 php=2 phpRSS=32 ap=51 tcp=43 topuser=root 2026-09-04 21:49:49 L1=0.31 run=1 blk=0 avail=7574 (55.0%) swpO=0 conn=2 myRSS=3421 php=2 phpRSS=32 ap=50 tcp=38 topuser=root 2026-09-04 21:49:58 L1=0.34 run=2 blk=0 avail=7482 (54.3%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=206 ap=41 tcp=31 topuser=madalice 2026-09-04 21:49:59 L1=0.34 run=4 blk=0 avail=7531 (54.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=40 tcp=31 topuser=madalice 2026-09-04 21:50:08 L1=0.44 run=3 blk=0 avail=7588 (55.1%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=31 tcp=26 topuser=madalice 2026-09-04 21:50:09 L1=0.44 run=6 blk=0 avail=7593 (55.1%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=30 tcp=26 topuser=madalice 2026-09-04 21:50:18 L1=0.37 run=1 blk=0 avail=7677 (55.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=21 tcp=23 topuser=madalice 2026-09-04 21:50:19 L1=0.37 run=1 blk=0 avail=7684 (55.8%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=20 tcp=24 topuser=madalice 2026-09-04 21:50:28 L1=0.32 run=1 blk=0 avail=7711 (56.0%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=15 tcp=30 topuser=madalice 2026-09-04 21:50:29 L1=0.32 run=1 blk=0 avail=7710 (56.0%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=15 tcp=30 topuser=madalice 2026-09-04 21:50:38 L1=0.27 run=1 blk=0 avail=7704 (55.9%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=15 tcp=32 topuser=madalice 2026-09-04 21:50:39 L1=0.27 run=2 blk=0 avail=7703 (55.9%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=165 ap=15 tcp=32 topuser=madalice 2026-09-04 21:50:48 L1=0.45 run=1 blk=0 avail=7678 (55.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=191 ap=17 tcp=29 topuser=madalice 2026-09-04 21:50:49 L1=0.45 run=1 blk=0 avail=7678 (55.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=191 ap=17 tcp=29 topuser=madalice 2026-09-04 21:50:58 L1=0.69 run=3 blk=0 avail=7421 (53.9%) swpO=0 conn=1 myRSS=3421 php=6 phpRSS=547 ap=15 tcp=26 topuser=madalice 2026-09-04 21:50:59 L1=0.69 run=1 blk=0 avail=7694 (55.8%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=190 ap=15 tcp=23 topuser=madalice 2026-09-04 21:51:08 L1=0.58 run=1 blk=0 avail=7583 (55.0%) swpO=0 conn=1 myRSS=3421 php=4 phpRSS=314 ap=16 tcp=23 topuser=madalice 2026-09-04 21:51:09 L1=0.58 run=1 blk=0 avail=7583 (55.0%) swpO=0 conn=1 myRSS=3421 php=4 phpRSS=314 ap=16 tcp=24 topuser=madalice 2026-09-04 21:51:18 L1=0.57 run=1 blk=0 avail=7590 (55.1%) swpO=0 conn=1 myRSS=3421 php=4 phpRSS=314 ap=15 tcp=26 topuser=madalice 2026-09-04 21:51:19 L1=0.57 run=1 blk=0 avail=7589 (55.1%) swpO=0 conn=1 myRSS=3421 php=4 phpRSS=314 ap=15 tcp=25 topuser=madalice 2026-09-04 21:51:28 L1=0.48 run=1 blk=0 avail=7815 (56.7%) swpO=0 conn=1 myRSS=3421 php=2 phpRSS=32 ap=16 tcp=31 topuser=root 2026-09-04 21:51:29 L1=0.48 run=1 blk=0 avail=7816 (56.7%) swpO=0 conn=1 myRSS=3421 php=2 phpRSS=32 ap=16 tcp=27 topuser=root 2026-09-04 21:51:39 L1=0.48 run=2 blk=0 avail=7680 (55.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=189 ap=16 tcp=27 topuser=madalice 2026-09-04 21:51:39 L1=0.48 run=1 blk=0 avail=7678 (55.7%) swpO=0 conn=1 myRSS=3421 php=3 phpRSS=189 ap=16 tcp=27 topuser=madalice 2026-09-04 21:51:49 L1=2.18 run=13 blk=0 avail=6771 (49.2%) swpO=1 conn=10 myRSS=3421 php=12 phpRSS=1267 ap=33 tcp=35 topuser=evolution 2026-09-04 21:51:49 L1=2.18 run=9 blk=0 avail=6854 (49.7%) swpO=1 conn=1 myRSS=3421 php=11 phpRSS=1163 ap=33 tcp=31 topuser=evolution 2026-09-04 21:51:59 L1=2.45 run=11 blk=0 avail=6036 (43.8%) swpO=0 conn=11 myRSS=3421 php=12 phpRSS=1979 ap=28 tcp=54 topuser=madalice 2026-09-04 21:52:00 L1=2.45 run=19 blk=0 avail=6374 (46.3%) swpO=0 conn=11 myRSS=3421 php=12 phpRSS=1586 ap=32 tcp=55 topuser=madalice