INCIDENT 2026-09-06 06:39:22 trigger: php_rss=1544MB ================================================================== load: 2.21 1.99 2.10 10/673 1045766 ncpu:10 mem_avail: 9105MB/13777MB (66.1%) swap_used:1940MB swapout:131/s blocked(D):1 running:10 iowait:6.9% steal:0.0% php: 17 procs / 1544MB heaviest user: alison (4 procs, 378MB) apache: 76 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 75 1058 root 250 890 mysql 1 799 alison 4 390 mailman 20 270 netdata 8 246 corpkicks 2 204 customc 2 196 evolution 12 188 speedlin 2 174 madalice 1 155 vinesit 1 91 cpanellogin 1 73 wp-toolkit 3 69 tubesupplies 1 67 dovenull 6 55 named 1 37 mailnull 1 22 dovecot 3 21 polkitd 1 16 --- php workers by user --- USER PROCS RSS_MB alison 4 393 customc 2 200 corpkicks 1 193 speedlin 2 184 evolution 4 176 madalice 1 155 vinesit 1 92 tubesupplies 1 69 root 1 29 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8462 MB Active(file): 3570 MB Inactive(file): 4754 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 619 MB CommitLimit: 10984 MB Committed_AS: 10271 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-04:16:56 5576 /usr/bin/imunify-agent-proxy 4109079 root 1-01:54:34 1764 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-01:54:34 86328 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 819064 2.7 Rsl 11:02:52 /usr/sbin/mariadbd 1045696 1045594 corpkicks 213216 48.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 166870 1 netdata 183508 2.7 Ssl 04:17:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220206 168913 root 176412 0.0 S 04:01:05 spamd child 1045071 167896 madalice 159340 7.0 S 00:47 php-fpm: pool madalice_com_au 1045678 1045643 speedlin 147520 37.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1045701 1045596 customc 134004 49.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1045704 1045648 alison 117208 77.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1045693 1045593 alison 112936 36.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1045685 1044688 alison 112748 37.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167871 1 root 108712 0.0 Ss 04:16:56 /usr/lib/systemd/systemd-journald 168913 1 root 99892 0.0 Ss 04:15:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1045713 1045628 customc 87472 25.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4109105 4109079 root 86328 2.0 Sl 1-01:54:35 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1045709 1045590 tubesupplies 77212 44.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 627522 1353308 cpanellogin 75520 0.0 S 02:02:28 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1045711 1045635 alison 73180 30.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1045760 1045595 speedlin 49576 10.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 41832 0.1 Ss 68-20:29:38 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1045794 1044687 evolution 40824 3.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 39972 0.1 Ss 46-03:58:09 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 39736 0.1 Sl 04:16:58 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 38000 0.0 Ss 04:17:07 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 166809 1 named 37916 0.0 Ssl 04:17:05 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509236 509098 root 34716 0.0 Sl 9-04:19:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 220207 168913 root 34632 0.0 S 04:01:05 spamd child 167896 1 root 30000 0.0 Ss 04:16:55 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 27072 0.0 Ss 04:16:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 24724 0.0 Ss 68-20:29:38 tailwatchd 508720 1 mailnull 22936 0.0 Ss 9-04:19:50 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 167814 1 root 22620 0.0 Ss 04:16:56 lfd - sleeping 1027579 506832 nobody 22176 0.0 S 05:34 /usr/sbin/httpd -k start 167017 1 root 21644 0.1 Ssl 04:17:02 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1027582 506832 nobody 20576 0.0 S 05:34 /usr/sbin/httpd -k start 1043943 506832 nobody 19448 0.0 S 02:33 /usr/sbin/httpd -k start 1044683 506832 nobody 18760 0.0 S 01:25 /usr/sbin/httpd -k start 1044682 506832 nobody 18356 0.0 S 01:25 /usr/sbin/httpd -k start 1043932 506832 nobody 18300 0.0 S 02:35 /usr/sbin/httpd -k start 1044678 506832 nobody 18248 0.0 S 01:26 /usr/sbin/httpd -k start 166757 1 root 17964 0.0 Ss 04:17:06 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1043952 506832 nobody 17164 0.0 S 02:32 /usr/sbin/httpd -k start 167566 166914 netdata 16620 2.1 Sl 04:16:58 /usr/libexec/netdata/plugins.d/apps.plugin 1 1045633 506832 nobody 16616 0.0 S 00:04 /usr/sbin/httpd -k start 1045602 506832 nobody 16600 0.2 S 00:05 /usr/sbin/httpd -k start 1044688 506832 nobody 16596 0.0 S 01:24 /usr/sbin/httpd -k start 1045626 506832 nobody 16532 0.0 S 00:04 /usr/sbin/httpd -k start 1045641 506832 nobody 16532 0.0 S 00:04 /usr/sbin/httpd -k start 1045625 506832 nobody 16500 0.0 S 00:04 /usr/sbin/httpd -k start 166667 1 polkitd 16488 0.0 Ssl 04:17:07 /usr/lib/polkit-1/polkitd --no-debug 1045639 506832 nobody 16472 0.0 S 00:04 /usr/sbin/httpd -k start 1045630 506832 nobody 16356 0.0 S 00:04 /usr/sbin/httpd -k start 1044695 506832 nobody 16244 0.1 S 01:23 /usr/sbin/httpd -k start 1044694 506832 nobody 16232 0.0 S 01:23 /usr/sbin/httpd -k start 1044687 506832 nobody 16188 0.2 S 01:24 /usr/sbin/httpd -k start 1045592 506832 nobody 16132 0.2 S 00:05 /usr/sbin/httpd -k start 1045634 506832 nobody 16076 0.0 S 00:04 /usr/sbin/httpd -k start 1045596 506832 nobody 16064 0.2 S 00:05 /usr/sbin/httpd -k start 1045594 506832 nobody 16048 0.2 S 00:05 /usr/sbin/httpd -k start 1045590 506832 nobody 16036 0.2 S 00:05 /usr/sbin/httpd -k start 1045595 506832 nobody 16028 0.2 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 291496 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 291495 | root | 108-1481181613 | Execute | 0 | Sending data | select inventory.id, inventory.status, inventory.code, (SELECT name from categories where categories.id = inventory.cat) as category, inventory.cat, inventory.desc as description, inventory.cost, (SELECT company from contacts where inventory.psupplier = contacts.cl | +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 263 evolution/app.evolutionerp.com.au-ssl_log 128 evolution/my.evolutionerp.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 6 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 261 35.186.154.240 128 40.115.94.245 11 34.156.31.47 1 84.75.155.208 1 81.70.203.246 1 54.236.1.199 1 40.77.167.28 1 20.205.10.93 1 114.119.143.14 1 114.119.143.104 1 114.119.140.234 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 35 GET /api/getItem/LWHG2001KG 4 POST / 4 GET /api/getItem/PWFBW3151KG 2 GET /store/db-custom-shoes/ 2 GET /store/db12/ 2 GET /.env.production 2 GET /.env.prod 2 GET /.env.local 2 GET /.env.dev 2 GET /.env.backup 2 GET /.env 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/CLFBNSTD45315KK 2 GET / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp-json/wp/v2/tags/995 1 GET /wp/.env --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 35.186.154.240 - - [06/Sep/2026:06:39:16 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:16 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:16 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:17 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:17 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:17 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:17 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:17 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:17 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.186.154.240 - - [06/Sep/2026:06:39:17 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 35 GET /api/getItem/LWHG2001KG 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/CLFBNSTD45315KK 1 GET /api/getItem/SHSG909020-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757530-8 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:06:39:06 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:07 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:07 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:07 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:08 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:08 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:06:39:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /wp-config.php.bak 1 GET /storage/logs/laravel.log 1 GET /_ignition/health-check 1 GET /.env.production 1 GET /.env.prod 1 GET /.env.local 1 GET /.env.dev 1 GET /.env.backup 1 GET /env 1 GET /.env 1 GET /docs/shopify/overview.php 1 GET /actuator/env -- last 10 requests -- 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /.env HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /storage/logs/laravel.log HTTP/1.1" 404 - "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /wp-config.php.bak HTTP/1.1" 404 - "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /.env.prod HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /actuator/env HTTP/1.1" 404 - "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /.env.dev HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /env HTTP/1.1" 404 - "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:56 +1000] "GET /_ignition/health-check HTTP/1.1" 404 - "-" "crusader-worker/1.0" 34.156.31.47 - - [06/Sep/2026:06:37:57 +1000] "GET /.env.backup HTTP/1.1" 403 12 "-" "crusader-worker/1.0" --- last 30 samples (run-up to this incident) --- 2026-09-06 06:37:01 L1=1.74 run=6 blk=1 avail=10478(76.1%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=24 tcp=35 topuser=madalice 2026-09-06 06:37:01 L1=1.74 run=3 blk=1 avail=10478(76.1%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=24 tcp=36 topuser=madalice 2026-09-06 06:37:11 L1=1.70 run=3 blk=1 avail=10540(76.5%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=16 tcp=25 topuser=madalice 2026-09-06 06:37:11 L1=1.70 run=3 blk=1 avail=10533(76.5%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=16 tcp=25 topuser=madalice 2026-09-06 06:37:22 L1=1.60 run=2 blk=1 avail=10549(76.6%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=14 tcp=25 topuser=madalice 2026-09-06 06:37:22 L1=1.60 run=2 blk=1 avail=10549(76.6%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=14 tcp=25 topuser=madalice 2026-09-06 06:37:32 L1=1.58 run=1 blk=1 avail=10554(76.6%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=14 tcp=25 topuser=madalice 2026-09-06 06:37:32 L1=1.58 run=4 blk=1 avail=10554(76.6%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=162 ap=14 tcp=25 topuser=madalice 2026-09-06 06:37:42 L1=1.57 run=3 blk=1 avail=10660(77.4%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=68 ap=14 tcp=27 topuser=madalice 2026-09-06 06:37:42 L1=1.57 run=5 blk=1 avail=10659(77.4%) swpO=0 conn=1 myRSS=801 php=5 phpRSS=70 ap=14 tcp=27 topuser=madalice 2026-09-06 06:37:52 L1=1.56 run=2 blk=1 avail=10339(75.0%) swpO=0 conn=1 myRSS=801 php=7 phpRSS=412 ap=15 tcp=25 topuser=madalice 2026-09-06 06:37:52 L1=1.56 run=3 blk=1 avail=10339(75.0%) swpO=0 conn=1 myRSS=801 php=7 phpRSS=412 ap=15 tcp=25 topuser=madalice 2026-09-06 06:38:02 L1=1.47 run=3 blk=1 avail=10289(74.7%) swpO=0 conn=1 myRSS=801 php=7 phpRSS=374 ap=29 tcp=32 topuser=madalice 2026-09-06 06:38:02 L1=1.47 run=2 blk=1 avail=10291(74.7%) swpO=0 conn=2 myRSS=801 php=7 phpRSS=372 ap=29 tcp=32 topuser=madalice 2026-09-06 06:38:12 L1=1.56 run=3 blk=1 avail=10410(75.6%) swpO=0 conn=2 myRSS=801 php=6 phpRSS=299 ap=21 tcp=26 topuser=alison 2026-09-06 06:38:12 L1=1.56 run=3 blk=1 avail=10411(75.6%) swpO=0 conn=2 myRSS=801 php=6 phpRSS=299 ap=21 tcp=26 topuser=alison 2026-09-06 06:38:22 L1=1.80 run=1 blk=1 avail=10555(76.6%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=162 ap=15 tcp=24 topuser=madalice 2026-09-06 06:38:22 L1=1.80 run=2 blk=1 avail=10554(76.6%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=162 ap=15 tcp=24 topuser=madalice 2026-09-06 06:38:32 L1=1.67 run=2 blk=1 avail=10554(76.6%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=154 ap=15 tcp=23 topuser=madalice 2026-09-06 06:38:32 L1=1.67 run=2 blk=1 avail=10553(76.6%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=51 ap=15 tcp=23 topuser=root 2026-09-06 06:38:42 L1=1.57 run=1 blk=1 avail=10565(76.7%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=162 ap=15 tcp=28 topuser=madalice 2026-09-06 06:38:42 L1=1.57 run=2 blk=1 avail=10563(76.7%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=162 ap=15 tcp=28 topuser=madalice 2026-09-06 06:38:52 L1=1.56 run=1 blk=1 avail=10532(76.4%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=184 ap=15 tcp=27 topuser=madalice 2026-09-06 06:38:52 L1=1.56 run=2 blk=1 avail=10530(76.4%) swpO=0 conn=2 myRSS=801 php=5 phpRSS=184 ap=15 tcp=27 topuser=madalice 2026-09-06 06:39:02 L1=1.54 run=4 blk=1 avail=10109(73.4%) swpO=0 conn=2 myRSS=801 php=7 phpRSS=518 ap=15 tcp=31 topuser=corpkicks 2026-09-06 06:39:02 L1=1.54 run=3 blk=1 avail=10112(73.4%) swpO=0 conn=3 myRSS=801 php=7 phpRSS=516 ap=15 tcp=31 topuser=corpkicks 2026-09-06 06:39:12 L1=1.77 run=2 blk=1 avail=10492(76.2%) swpO=84 conn=3 myRSS=801 php=7 phpRSS=279 ap=15 tcp=25 topuser=madalice 2026-09-06 06:39:12 L1=1.77 run=4 blk=1 avail=10483(76.1%) swpO=84 conn=3 myRSS=801 php=6 phpRSS=257 ap=15 tcp=25 topuser=madalice 2026-09-06 06:39:22 L1=2.21 run=11 blk=1 avail=9092 (66.0%) swpO=131 conn=3 myRSS=799 php=17 phpRSS=1420 ap=76 tcp=56 topuser=alison 2026-09-06 06:39:22 L1=2.21 run=10 blk=1 avail=9105 (66.1%) swpO=131 conn=12 myRSS=799 php=17 phpRSS=1544 ap=76 tcp=56 topuser=alison