INCIDENT 2026-09-05 03:29:03 trigger: php_rss=1648MB ================================================================== load: 1.52 1.57 1.63 14/699 3850743 ncpu:10 mem_avail: 6589MB/13777MB (47.8%) swap_used:1775MB swapout:292/s blocked(D):0 running:14 iowait:8.8% steal:0.0% php: 15 procs / 1648MB heaviest user: evolution (13 procs, 1486MB) apache: 18 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3288 evolution 22 1803 root 250 1388 nobody 17 288 netdata 8 258 madalice 1 133 dovenull 6 65 cpanellogin 1 65 wp-toolkit 3 55 kurri 3 43 lowrange 2 30 infinium 2 28 dovecot 3 28 mailman 20 26 mailnull 3 17 zabbix 1 10 polkitd 1 7 named 1 6 nscd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 14 1811 madalice 1 133 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4615 MB Active(file): 4062 MB Inactive(file): 1236 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 926 MB CommitLimit: 10984 MB Committed_AS: 8779 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3814865 root 11:50 4572 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 3814884 root 11:48 390604 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress 3926885 root 4-01:06:37 3960 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3367468 12.4 Ssl 2-13:14:52 /usr/sbin/mariadbd 3814884 3814865 root 390604 4.5 Sl 11:48 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 191728 2.6 Ssl 2-01:06:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3850707 3848502 evolution 188128 102 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3850703 3848499 evolution 186544 102 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3850706 3848501 evolution 186340 96.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3850702 3848503 evolution 184256 104 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3850709 3848110 evolution 183560 102 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3643624 3626973 root 183096 0.0 S 01:02:14 spamd child 3850705 3849583 evolution 183008 98.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3850710 3814415 evolution 179220 103 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3626973 1 root 175612 0.1 Ss 01:05:49 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3850708 3850500 evolution 175228 100 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3643625 3626973 root 167792 0.0 S 01:02:14 spamd child 3850520 2601907 madalice 137080 7.2 S 00:17 php-fpm: pool madalice_com_au 3454439 1353308 cpanellogin 66620 0.0 S 01:57:43 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3127357 3127312 evolution 63156 0.0 Ss 03:29:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 60100 0.0 Ss 03:29:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509236 509098 root 42600 0.0 Sl 8-01:09:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1542981 1542551 netdata 40900 0.1 Sl 2-01:06:38 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40876 0.1 Ss 45-00:47:49 cpsrvd (SSL) - waiting for connections 1469 1 root 40308 0.1 Ss 67-17:19:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3626082 1 root 35880 0.0 Ss 01:06:49 lfd - sleeping 509266 1 root 34156 0.0 Ss 8-01:09:23 /usr/lib/systemd/systemd-journald 1542487 1 wp-toolkit 30232 0.0 Ss 2-01:06:42 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28908 0.0 Ss 1-01:05:38 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 26072 0.0 Ss 67-17:19:18 tailwatchd 3848113 506832 nobody 22464 0.0 S 03:50 /usr/sbin/httpd -k start 2602226 1 root 21988 0.1 Ssl 1-01:05:23 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3814415 506832 nobody 21640 0.0 S 12:01 /usr/sbin/httpd -k start 3848499 506832 nobody 21432 0.0 S 03:06 /usr/sbin/httpd -k start 3848503 506832 nobody 20896 0.0 S 03:06 /usr/sbin/httpd -k start 3848469 506832 nobody 20852 0.1 S 03:08 /usr/sbin/httpd -k start 3848502 506832 nobody 20572 0.0 S 03:06 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 20380 0.0 Ss 2-01:06:41 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3848501 506832 nobody 20360 0.0 S 03:06 /usr/sbin/httpd -k start 3848110 506832 nobody 20128 0.0 S 03:50 /usr/sbin/httpd -k start 3848091 506832 nobody 19684 0.1 S 03:51 /usr/sbin/httpd -k start 3849583 506832 nobody 19352 0.0 S 01:56 /usr/sbin/httpd -k start 1542982 1542551 netdata 18784 2.1 Sl 2-01:06:38 /usr/libexec/netdata/plugins.d/apps.plugin 1 3850509 506832 nobody 17948 0.0 S 00:19 /usr/sbin/httpd -k start 3850501 506832 nobody 17908 0.0 S 00:20 /usr/sbin/httpd -k start 3850494 506832 nobody 17136 0.0 S 00:21 /usr/sbin/httpd -k start 3850500 506832 nobody 17096 0.0 S 00:20 /usr/sbin/httpd -k start 1542141 1 root 16940 0.0 Ss 2-01:06:45 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3212102 508511 lowrange 15724 0.0 S 03:07:01 dovecot/imap 3539428 508511 lowrange 15400 0.0 S 01:32:56 dovecot/imap 3160309 508511 kurri 15172 0.0 S 03:21:50 dovecot/imap 3815326 508511 infinium 14720 0.0 S 11:07 dovecot/imap 3745174 508511 infinium 14628 0.0 S 33:07 dovecot/imap 3850699 508511 kurri 14624 0.0 S 00:02 dovecot/imap 3141944 508511 kurri 14352 0.0 S 03:28:41 dovecot/imap 3832905 1471 root 14240 0.0 S 05:36 cPhulkd - processor - http socket 690514 508511 dovecot 13912 0.0 S 14:56:14 dovecot/auth 2508826 1471 root 13504 0.0 S 1-01:32:07 cPhulkd - dbprocessor 690505 508511 dovenull 13316 0.0 S 14:56:14 dovecot/imap-login 690509 508511 dovenull 13104 0.0 S 14:56:14 dovecot/imap-login 3849571 508511 root 12964 0.0 S 01:57 dovecot/auth -w 506832 1 root 12956 0.0 Ss 8-01:09:56 /usr/sbin/httpd -k start 1471 1 root 12484 0.0 Ss 67-17:19:18 cPhulkd - processor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10638261 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10638241 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Sending data | SHOW FULL COLUMNS FROM `QpCIPREUS_options` | +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 110 evolution/app.evolutionerp.com.au-ssl_log 86 evolution/evolutionerp.com.au-ssl_log 39 otter2/otterfencing.net.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 10 madalice/madalice.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 110 130.12.180.194 86 40.115.94.245 35 34.40.79.89 33 103.73.53.4 10 203.54.180.238 3 160.153.188.148 2 202.170.197.168 1 34.30.34.107 1 129.146.56.234 1 118.127.40.55 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 63 GET /api/getItem/LWFBW2001KG 10 GET /heartbeat.php 3 POST /owa/auth.owa 2 GET /terms-of-use/ 2 GET /terms-of-use 2 GET /stocked-with-excellence-key-features-of-inventory-systems/ 2 GET /stocked-with-excellence-key-features-of-inventory-systems 2 GET /privacy-policy/ 2 GET /privacy-policy 2 GET /manufacturing-software/ 2 GET /manufacturing-software 2 GET /contact-us/ 2 GET / 1 POST /wp-cron.php 1 GET /www/phpinfo.php 1 GET /www/.env.production 1 GET /www/.env.prod 1 GET /www/.env.local 1 GET /www/.env.development 1 GET /www/.env --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 GET /www/.env.production 1 GET /www/.env.prod 1 GET /www/.env.local 1 GET /www/.env.development 1 GET /www/.env 1 GET /web/.env.uat 1 GET /web/.env.test 1 GET /web/.env.swp 1 GET /web/.env.staging 1 GET /web/.env.stage 1 GET /web/.env.save 1 GET /web/.env.sample -- last 10 requests -- 130.12.180.194 - - [05/Sep/2026:03:28:12 +1000] "GET /web/.env.bak HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:13 +1000] "GET /web/.env.backup HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:14 +1000] "GET /web/.env.old HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:14 +1000] "GET /web/.env.save HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:14 +1000] "GET /web/.env.swp HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:14 +1000] "GET /www/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:15 +1000] "GET /www/.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:15 +1000] "GET /www/.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:15 +1000] "GET /www/.env.prod HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 130.12.180.194 - - [05/Sep/2026:03:28:16 +1000] "GET /www/.env.development HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 63 GET /api/getItem/LWFBW2001KG 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/H8040 1 GET /api/getItem/H8032D 1 GET /api/getItem/H8025D 1 GET /api/getItem/H5032 1 GET /api/getItem/H5025D -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:03:28:51 +1000] "GET /api/getItem/H10025 HTTP/1.1" 404 108 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:51 +1000] "GET /api/getItem/H10032 HTTP/1.1" 200 1347 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:51 +1000] "GET /api/getItem/H10040 HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:52 +1000] "GET /api/getItem/S1 HTTP/1.1" 200 1423 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:52 +1000] "GET /api/getItem/S2 HTTP/1.1" 200 1431 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:53 +1000] "GET /api/getItem/S3 HTTP/1.1" 200 1428 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:53 +1000] "GET /api/getItem/S4 HTTP/1.1" 200 1426 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:54 +1000] "GET /api/getItem/S5 HTTP/1.1" 200 1426 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:54 +1000] "GET /api/getItem/S6 HTTP/1.1" 200 1426 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:28:55 +1000] "GET /api/getItem/GEB12-SL HTTP/1.1" 200 1571 "-" "RestSharp/106.13.0.0" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 3 POST /owa/auth.owa 2 GET /terms-of-use/ 2 GET /terms-of-use 2 GET /stocked-with-excellence-key-features-of-inventory-systems/ 2 GET /stocked-with-excellence-key-features-of-inventory-systems 2 GET /privacy-policy/ 2 GET /privacy-policy 2 GET /manufacturing-software/ 2 GET /manufacturing-software 2 GET /contact-us/ 2 GET / 1 POST /wp-cron.php -- last 10 requests -- 103.73.53.4 - - [05/Sep/2026:03:28:43 +1000] "GET /manufacturing-software/ HTTP/1.1" 200 193957 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:45 +1000] "GET /privacy-policy/ HTTP/1.1" 200 198970 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /what-is-evolutionerp/ HTTP/1.1" 200 202183 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /category/construction/ HTTP/1.1" 200 213190 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /construction-software/ HTTP/1.1" 200 209070 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /book-a-free-consultation/ HTTP/1.1" 200 234529 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /crm-for-sales-team/ HTTP/1.1" 200 204068 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /blogs/ HTTP/1.1" 200 255113 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /estimating/ HTTP/1.1" 200 190056 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" 103.73.53.4 - - [05/Sep/2026:03:28:52 +1000] "GET /mobile-application/ HTTP/1.1" 200 194592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-05 03:26:41 L1=1.88 run=1 blk=1 avail=7609 (55.2%) swpO=1 conn=3 myRSS=3295 php=5 phpRSS=304 ap=18 tcp=28 topuser=madalice 2026-09-05 03:26:42 L1=1.81 run=1 blk=1 avail=7614 (55.3%) swpO=1 conn=3 myRSS=3295 php=5 phpRSS=304 ap=17 tcp=29 topuser=madalice 2026-09-05 03:26:51 L1=1.83 run=1 blk=1 avail=7639 (55.4%) swpO=2 conn=3 myRSS=3295 php=5 phpRSS=304 ap=14 tcp=27 topuser=madalice 2026-09-05 03:26:52 L1=1.76 run=1 blk=1 avail=7635 (55.4%) swpO=2 conn=3 myRSS=3295 php=5 phpRSS=304 ap=14 tcp=27 topuser=madalice 2026-09-05 03:27:01 L1=1.70 run=1 blk=1 avail=7633 (55.4%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=304 ap=14 tcp=30 topuser=madalice 2026-09-05 03:27:02 L1=1.64 run=1 blk=1 avail=7630 (55.4%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=304 ap=14 tcp=29 topuser=madalice 2026-09-05 03:27:11 L1=1.67 run=1 blk=1 avail=7609 (55.2%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=308 ap=15 tcp=28 topuser=madalice 2026-09-05 03:27:12 L1=1.62 run=1 blk=1 avail=7613 (55.3%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=308 ap=15 tcp=28 topuser=madalice 2026-09-05 03:27:21 L1=1.57 run=2 blk=1 avail=7560 (54.9%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=365 ap=15 tcp=29 topuser=madalice 2026-09-05 03:27:22 L1=1.68 run=1 blk=1 avail=7613 (55.3%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=309 ap=15 tcp=27 topuser=madalice 2026-09-05 03:27:31 L1=1.63 run=2 blk=1 avail=7611 (55.2%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=309 ap=15 tcp=27 topuser=madalice 2026-09-05 03:27:32 L1=1.58 run=1 blk=1 avail=7612 (55.3%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=309 ap=15 tcp=27 topuser=madalice 2026-09-05 03:27:41 L1=1.53 run=2 blk=1 avail=7595 (55.1%) swpO=0 conn=4 myRSS=3295 php=5 phpRSS=338 ap=14 tcp=28 topuser=madalice 2026-09-05 03:27:42 L1=1.57 run=1 blk=1 avail=7618 (55.3%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=309 ap=14 tcp=29 topuser=madalice 2026-09-05 03:27:51 L1=1.52 run=2 blk=1 avail=7445 (54.0%) swpO=0 conn=4 myRSS=3295 php=7 phpRSS=546 ap=14 tcp=30 topuser=infinium 2026-09-05 03:27:52 L1=1.56 run=1 blk=1 avail=7635 (55.4%) swpO=1 conn=3 myRSS=3295 php=5 phpRSS=309 ap=14 tcp=28 topuser=madalice 2026-09-05 03:28:01 L1=1.52 run=1 blk=1 avail=7629 (55.4%) swpO=1 conn=4 myRSS=3295 php=5 phpRSS=309 ap=14 tcp=27 topuser=madalice 2026-09-05 03:28:02 L1=1.64 run=2 blk=1 avail=7624 (55.3%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=314 ap=14 tcp=28 topuser=madalice 2026-09-05 03:28:11 L1=1.61 run=2 blk=1 avail=7456 (54.1%) swpO=1 conn=4 myRSS=3295 php=6 phpRSS=501 ap=14 tcp=32 topuser=evolution 2026-09-05 03:28:12 L1=1.61 run=1 blk=1 avail=7617 (55.3%) swpO=1 conn=3 myRSS=3295 php=5 phpRSS=309 ap=14 tcp=31 topuser=madalice 2026-09-05 03:28:21 L1=1.52 run=1 blk=1 avail=7614 (55.3%) swpO=0 conn=4 myRSS=3295 php=5 phpRSS=309 ap=14 tcp=28 topuser=madalice 2026-09-05 03:28:22 L1=1.52 run=1 blk=1 avail=7613 (55.3%) swpO=0 conn=3 myRSS=3295 php=5 phpRSS=309 ap=14 tcp=30 topuser=madalice 2026-09-05 03:28:31 L1=1.58 run=1 blk=1 avail=7585 (55.1%) swpO=0 conn=4 myRSS=3300 php=5 phpRSS=309 ap=17 tcp=33 topuser=madalice 2026-09-05 03:28:32 L1=1.58 run=5 blk=1 avail=7567 (54.9%) swpO=0 conn=3 myRSS=3300 php=5 phpRSS=309 ap=17 tcp=34 topuser=madalice 2026-09-05 03:28:41 L1=1.64 run=1 blk=1 avail=7596 (55.1%) swpO=0 conn=3 myRSS=3300 php=5 phpRSS=309 ap=15 tcp=31 topuser=madalice 2026-09-05 03:28:42 L1=1.64 run=8 blk=1 avail=7199 (52.3%) swpO=0 conn=3 myRSS=3300 php=11 phpRSS=893 ap=15 tcp=41 topuser=evolution 2026-09-05 03:28:51 L1=1.62 run=1 blk=1 avail=7585 (55.1%) swpO=0 conn=3 myRSS=3300 php=5 phpRSS=282 ap=21 tcp=29 topuser=madalice 2026-09-05 03:28:53 L1=1.62 run=15 blk=1 avail=6856 (49.8%) swpO=0 conn=3 myRSS=3300 php=16 phpRSS=1454 ap=20 tcp=39 topuser=evolution 2026-09-05 03:29:01 L1=1.52 run=1 blk=1 avail=7540 (54.7%) swpO=292 conn=3 myRSS=3288 php=5 phpRSS=282 ap=19 tcp=31 topuser=madalice 2026-09-05 03:29:03 L1=1.52 run=14 blk=0 avail=6589 (47.8%) swpO=292 conn=14 myRSS=3288 php=15 phpRSS=1648 ap=18 tcp=40 topuser=evolution