INCIDENT 2026-09-05 01:06:28 trigger: php_rss=1713MB ================================================================== load: 0.99 0.88 0.88 15/703 3368279 ncpu:10 mem_avail: 6578MB/13777MB (47.7%) swap_used:1873MB swapout:797/s blocked(D):1 running:14 iowait:0.2% steal:0.0% php: 12 procs / 1713MB heaviest user: madalice (7 procs, 1443MB) apache: 17 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3268 madalice 7 1525 root 265 1041 nobody 16 278 netdata 8 255 wp-toolkit 5 151 evolution 11 144 customc 3 130 dovenull 6 65 lowrange 3 42 kurri 3 42 infinium 2 28 dovecot 3 28 mailman 20 25 cpanellogin 1 19 zabbix 1 12 polkitd 1 7 named 1 5 nscd 1 4 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 7 1431 customc 1 128 evolution 3 121 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5957 MB Active(file): 3057 MB Inactive(file): 2998 MB Dirty: 91 MB Writeback: 4 MB SReclaimable: 600 MB CommitLimit: 10984 MB Committed_AS: 8220 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3333720 root 06:28 1240 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 3-22:44:01 3916 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3347024 12.8 Ssl 2-10:52:16 /usr/sbin/mariadbd 3368201 2601907 madalice 248520 70.5 R 00:02 php-fpm: pool madalice_com_au 3368206 2601907 madalice 241600 65.5 R 00:02 php-fpm: pool madalice_com_au 3368204 2601907 madalice 228212 68.0 R 00:02 php-fpm: pool madalice_com_au 3368207 2601907 madalice 216336 64.5 R 00:02 php-fpm: pool madalice_com_au 1043892 2603077 root 197556 0.1 S 11:01:32 spamd child 3368211 2601907 madalice 191404 95.0 R 00:01 php-fpm: pool madalice_com_au 509266 1 root 191392 0.0 Ss 7-22:46:47 /usr/lib/systemd/systemd-journald 1542443 1 netdata 189088 2.6 Ssl 1-22:44:06 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3368069 2601907 madalice 159720 18.3 S 00:14 php-fpm: pool madalice_com_au 3368221 3368220 customc 144252 58.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php -r require '/usr/local/cpanel/3rdparty/wp-toolkit/plib/vendor/wp-cli/wpt-wp-cli.php'; -d safe_mod 3368203 2601907 madalice 137128 65.0 S 00:02 php-fpm: pool madalice_com_au 2603077 1 root 132996 0.0 Ss 22:42:17 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3349808 1542531 wp-toolkit 96348 1.1 S 03:04 /usr/bin/sw-engine -d auto_prepend_file=/usr/local/cpanel/3rdparty/wp-toolkit/scripts/scheduled-task-prepend-file.php /usr/local/cpanel 2654376 2603077 root 68508 0.0 S 22:27:21 spamd child 3127357 3127312 evolution 63176 0.0 Ss 01:06:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 61664 0.0 Ss 01:06:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509236 509098 root 43028 0.0 Sl 7-22:46:47 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42280 0.1 Ss 44-22:25:13 cpsrvd (SSL) - waiting for connections 1469 1 root 41580 0.1 Ss 67-14:56:42 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3368290 3367692 evolution 40884 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542981 1542551 netdata 40852 0.1 Sl 1-22:44:02 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3127515 1 root 36272 0.0 Ss 01:06:26 lfd - sleeping 1542487 1 wp-toolkit 30716 0.0 Ss 1-22:44:06 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28864 0.0 Ss 22:43:02 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 23464 0.0 Ss 67-14:56:42 tailwatchd 2602226 1 root 23096 0.1 Ssl 22:42:47 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3349726 506832 nobody 22876 0.0 S 03:17 /usr/sbin/httpd -k start 3315934 506832 nobody 22808 0.0 S 12:28 /usr/sbin/httpd -k start 3349703 506832 nobody 22484 0.0 S 03:17 /usr/sbin/httpd -k start 3349637 506832 nobody 21660 0.0 S 03:21 /usr/sbin/httpd -k start 3349685 506832 nobody 21572 0.0 S 03:18 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 20656 0.0 Ss 1-22:44:05 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3349678 506832 nobody 20588 0.0 S 03:18 /usr/sbin/httpd -k start 3349671 506832 nobody 20548 0.0 S 03:19 /usr/sbin/httpd -k start 3348671 1353308 cpanellogin 19632 0.0 S 05:03 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3366708 506832 nobody 19484 0.0 S 01:04 /usr/sbin/httpd -k start 3366590 506832 nobody 19480 0.0 S 01:07 /usr/sbin/httpd -k start 1542982 1542551 netdata 18324 2.1 Sl 1-22:44:02 /usr/libexec/netdata/plugins.d/apps.plugin 1 3361260 506832 nobody 18216 0.0 S 01:20 /usr/sbin/httpd -k start 3367593 506832 nobody 18160 0.0 S 00:34 /usr/sbin/httpd -k start 3366629 506832 nobody 18116 0.0 S 01:06 /usr/sbin/httpd -k start 1542141 1 root 16948 0.0 Ss 1-22:44:09 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3367692 506832 nobody 16848 0.1 S 00:31 /usr/sbin/httpd -k start 3368226 506832 nobody 16476 0.0 S 00:01 /usr/sbin/httpd -k start 3228143 508511 lowrange 15352 0.0 S 41:09 dovecot/imap 3160309 508511 kurri 15132 0.0 S 59:14 dovecot/imap 690513 508511 root 14964 0.0 S 12:33:38 dovecot/config 3229469 508511 infinium 14692 0.0 S 38:50 dovecot/imap 3212102 508511 lowrange 14680 0.0 S 44:25 dovecot/imap 3349250 508511 infinium 14592 0.0 S 03:53 dovecot/imap 3368185 508511 kurri 14524 0.0 S 00:05 dovecot/imap 3141944 508511 kurri 14352 0.0 S 01:06:05 dovecot/imap 690514 508511 dovecot 13912 0.0 S 12:33:38 dovecot/auth 2508826 1471 root 13584 0.0 S 23:09:31 cPhulkd - dbprocessor 3367235 508511 lowrange 13484 0.0 S 00:47 dovecot/quota-status -p postfix 690505 508511 dovenull 13412 0.0 S 12:33:38 dovecot/imap-login 506832 1 root 13000 0.0 Ss 7-22:47:20 /usr/sbin/httpd -k start 690509 508511 dovenull 12948 0.0 S 12:33:38 dovecot/imap-login 3349644 508511 root 12920 0.0 S 03:20 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10582561 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10582519 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT user_id, meta_key, meta_value FROM AMuqf6qZ_usermeta WHERE user_id IN (1) ORDER BY umeta_id ASC | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 83 evolution/app.evolutionerp.com.au-ssl_log 71 madalice/madalice.com.au-ssl_log 7 nrg/nrgservices.net.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 6 evolution/portal.evolutionerp.com.au-ssl_log 5 evolution/my.evolutionerp.com.au-ssl_log 4 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 82 34.32.122.200 71 40.115.94.245 5 203.54.180.238 2 40.77.167.51 2 157.55.39.14 2 118.127.40.55 2 114.119.131.88 1 97.85.106.140 1 94.204.16.13 1 80.94.92.175 1 74.125.212.33 1 54.157.112.104 1 45.165.22.112 1 36.255.97.173 1 34.196.51.17 --- top request paths across all vhosts (last 3 min) --- 44 GET /api/getItem/LWFB2001KG 16 GET /api/getItem/LWPB2001KG 5 GET /heartbeat.php 4 POST / 4 GET /index.php 2 POST /wp-cron.php 2 GET /.env 2 GET / 1 HEAD / 1 GET /xmlrpc.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /.well-known/traffic-advice 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /symfony/.env 1 GET /store/veja-custom-swarovskius9/ 1 GET /store/tie-dye-socks/ --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 4 POST / 2 GET / 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /symfony/.env 1 GET /storage/.env 1 GET /staging/.env 1 GET /src/.env -- last 10 requests -- 34.32.122.200 - - [05/Sep/2026:01:06:22 +1000] "GET /opt/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:22 +1000] "GET /laravel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:22 +1000] "GET /symfony/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:23 +1000] "GET /wordpress/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:23 +1000] "GET /wp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:23 +1000] "GET /cms/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:24 +1000] "GET /drupal/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:24 +1000] "GET /joomla/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:24 +1000] "GET /magento/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.32.122.200 - - [05/Sep/2026:01:06:25 +1000] "GET /shopify/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 44 GET /api/getItem/LWFB2001KG 16 GET /api/getItem/LWPB2001KG 1 GET /api/getItem/RGW100T 1 GET /api/getItem/PC7550 1 GET /api/getItem/PC5025BL 1 GET /api/getItem/PC19 1 GET /api/getItem/PC16 1 GET /api/getItem/PC15050 1 GET /api/getItem/L2 1 GET /api/getItem/HCR-40 1 GET /api/getItem/HCR-32 1 GET /api/getItem/HCR-25 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:01:05:17 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:17 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:18 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:18 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:18 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:01:05:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 1 GET /xmlrpc.php 1 GET /store/veja-custom-swarovskius9/ 1 GET /store/tie-dye-socks/ 1 GET /store/sage-greens-kids-custom-painted-shoes/ 1 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 1 GET /store/hand-painted-nike-af1-baby/ 1 GET /store/hand-painted-nike-af1-afl-richmond/ -- last 10 requests -- 114.119.131.88 - - [05/Sep/2026:01:04:00 +1000] "GET /store/hand-painted-nike-af1-pink-pastel-flower/?amp%3Brating=1&wcpr_rating=5&wcpr_image=1&wcpr_page=2 HTTP/1.1" 301 1 "https://madalice.com.au/store/hand-painted-nike 36.255.97.173 - - [05/Sep/2026:01:04:25 +1000] "GET /xmlrpc.php HTTP/1.1" 404 36613 "http://madalice.com.au/xmlrpc.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17. 114.119.140.234 - - [05/Sep/2026:01:04:26 +1000] "GET /store/hand-painted-nike-af1-baby/?amp%3Bwcpr_page=2&wcpr_image=1&image=1&rating=2 HTTP/1.1" 404 36661 "https://madalice.com.au/store/hand-painted-nike-af1-baby/?imag 114.119.159.70 - - [05/Sep/2026:01:04:45 +1000] "GET /store/hand-painted-nike-af1-afl-richmond/?rating=3&wcpr_page=4 HTTP/1.1" 404 36659 "https://madalice.com.au/store/hand-painted-nike-af1-afl-richmond/?rating=3&wcpr_pa 114.119.143.14 - - [05/Sep/2026:01:05:07 +1000] "GET /store/veja-custom-swarovskius9/?image=1&rating=4 HTTP/1.1" 200 50228 "https://madalice.com.au/store/veja-custom-swarovskius9/?image=1&rating=4" "Mozilla/5.0 (Linux; A 114.119.146.16 - - [05/Sep/2026:01:05:30 +1000] "GET /store/tie-dye-socks/?amp%3Bwcpr_rating=1&image=1&rating=2 HTTP/1.1" 404 36656 "https://madalice.com.au/store/tie-dye-socks/?image=1&wcpr_rating=1" "Mozilla/5.0 (Linux 114.119.131.88 - - [05/Sep/2026:01:05:51 +1000] "GET /store/sage-greens-kids-custom-painted-shoes/?wcpr_image=1&rating=5&wcpr_rating=2&wcpr_page=2 HTTP/1.1" 404 36665 "https://madalice.com.au/store/sage-greens-kids-custo --- last 30 samples (run-up to this incident) --- 2026-09-05 01:04:07 L1=0.96 run=3 blk=0 avail=7610 (55.2%) swpO=0 conn=5 myRSS=3291 php=7 phpRSS=499 ap=23 tcp=26 topuser=evolution 2026-09-05 01:04:07 L1=0.96 run=3 blk=0 avail=7611 (55.2%) swpO=0 conn=6 myRSS=3291 php=7 phpRSS=500 ap=23 tcp=26 topuser=evolution 2026-09-05 01:04:17 L1=0.81 run=2 blk=0 avail=7605 (55.2%) swpO=0 conn=5 myRSS=3291 php=8 phpRSS=580 ap=15 tcp=32 topuser=evolution 2026-09-05 01:04:17 L1=0.81 run=5 blk=0 avail=7604 (55.2%) swpO=0 conn=6 myRSS=3291 php=8 phpRSS=582 ap=15 tcp=32 topuser=evolution 2026-09-05 01:04:27 L1=0.84 run=1 blk=0 avail=7563 (54.9%) swpO=53 conn=5 myRSS=3291 php=8 phpRSS=622 ap=14 tcp=30 topuser=evolution 2026-09-05 01:04:27 L1=0.84 run=2 blk=0 avail=7563 (54.9%) swpO=53 conn=6 myRSS=3291 php=8 phpRSS=622 ap=14 tcp=30 topuser=evolution 2026-09-05 01:04:37 L1=0.71 run=4 blk=0 avail=7388 (53.6%) swpO=2 conn=5 myRSS=3291 php=10 phpRSS=868 ap=13 tcp=31 topuser=evolution 2026-09-05 01:04:37 L1=0.71 run=4 blk=0 avail=7384 (53.6%) swpO=2 conn=6 myRSS=3291 php=10 phpRSS=868 ap=13 tcp=31 topuser=evolution 2026-09-05 01:04:47 L1=0.83 run=2 blk=0 avail=7545 (54.8%) swpO=0 conn=6 myRSS=3291 php=8 phpRSS=644 ap=13 tcp=29 topuser=evolution 2026-09-05 01:04:47 L1=0.83 run=1 blk=0 avail=7546 (54.8%) swpO=0 conn=5 myRSS=3291 php=8 phpRSS=644 ap=13 tcp=29 topuser=evolution 2026-09-05 01:04:58 L1=0.78 run=4 blk=0 avail=7586 (55.1%) swpO=0 conn=5 myRSS=3291 php=7 phpRSS=483 ap=13 tcp=32 topuser=madalice 2026-09-05 01:04:58 L1=0.78 run=9 blk=0 avail=7586 (55.1%) swpO=0 conn=4 myRSS=3291 php=7 phpRSS=483 ap=13 tcp=32 topuser=madalice 2026-09-05 01:05:08 L1=1.50 run=5 blk=0 avail=7660 (55.6%) swpO=0 conn=5 myRSS=3291 php=8 phpRSS=513 ap=13 tcp=35 topuser=madalice 2026-09-05 01:05:08 L1=1.50 run=5 blk=0 avail=7659 (55.6%) swpO=0 conn=4 myRSS=3291 php=8 phpRSS=527 ap=13 tcp=35 topuser=madalice 2026-09-05 01:05:18 L1=1.49 run=1 blk=0 avail=7530 (54.7%) swpO=0 conn=5 myRSS=3291 php=7 phpRSS=637 ap=14 tcp=33 topuser=corpkicks 2026-09-05 01:05:18 L1=1.49 run=2 blk=0 avail=7529 (54.6%) swpO=0 conn=4 myRSS=3291 php=7 phpRSS=637 ap=14 tcp=33 topuser=corpkicks 2026-09-05 01:05:28 L1=1.42 run=3 blk=0 avail=7730 (56.1%) swpO=0 conn=5 myRSS=3291 php=7 phpRSS=394 ap=20 tcp=37 topuser=evolution 2026-09-05 01:05:28 L1=1.42 run=4 blk=0 avail=7725 (56.1%) swpO=0 conn=4 myRSS=3291 php=7 phpRSS=400 ap=20 tcp=37 topuser=evolution 2026-09-05 01:05:38 L1=1.51 run=1 blk=1 avail=7808 (56.7%) swpO=0 conn=5 myRSS=3291 php=6 phpRSS=323 ap=14 tcp=29 topuser=evolution 2026-09-05 01:05:38 L1=1.51 run=3 blk=1 avail=7807 (56.7%) swpO=0 conn=4 myRSS=3291 php=6 phpRSS=323 ap=14 tcp=29 topuser=evolution 2026-09-05 01:05:48 L1=1.35 run=2 blk=0 avail=7766 (56.4%) swpO=3 conn=5 myRSS=3291 php=8 phpRSS=444 ap=14 tcp=28 topuser=evolution 2026-09-05 01:05:48 L1=1.35 run=6 blk=0 avail=7749 (56.2%) swpO=3 conn=4 myRSS=3291 php=8 phpRSS=458 ap=14 tcp=28 topuser=evolution 2026-09-05 01:05:58 L1=1.29 run=1 blk=0 avail=7404 (53.7%) swpO=0 conn=5 myRSS=3291 php=7 phpRSS=549 ap=16 tcp=34 topuser=customc 2026-09-05 01:05:58 L1=1.29 run=2 blk=0 avail=7404 (53.7%) swpO=0 conn=4 myRSS=3291 php=6 phpRSS=509 ap=16 tcp=34 topuser=customc 2026-09-05 01:06:08 L1=1.17 run=5 blk=0 avail=7352 (53.4%) swpO=0 conn=5 myRSS=3291 php=7 phpRSS=509 ap=16 tcp=31 topuser=corpkicks 2026-09-05 01:06:08 L1=1.17 run=9 blk=0 avail=7345 (53.3%) swpO=0 conn=4 myRSS=3291 php=7 phpRSS=534 ap=16 tcp=31 topuser=corpkicks 2026-09-05 01:06:18 L1=1.07 run=4 blk=0 avail=7418 (53.8%) swpO=88 conn=5 myRSS=3288 php=9 phpRSS=815 ap=16 tcp=36 topuser=evolution 2026-09-05 01:06:18 L1=1.07 run=10 blk=0 avail=7402 (53.7%) swpO=88 conn=4 myRSS=3288 php=9 phpRSS=821 ap=16 tcp=36 topuser=evolution 2026-09-05 01:06:28 L1=0.99 run=14 blk=1 avail=6578 (47.7%) swpO=797 conn=11 myRSS=3271 php=12 phpRSS=1713 ap=17 tcp=42 topuser=madalice 2026-09-05 01:06:28 L1=0.99 run=11 blk=0 avail=6544 (47.5%) swpO=827 conn=9 myRSS=3270 php=12 phpRSS=1764 ap=17 tcp=41 topuser=madalice