INCIDENT 2026-09-06 07:29:29 trigger: mysql_conn=15 ================================================================== load: 1.46 1.57 1.75 16/722 1218102 ncpu:10 mem_avail: 9400MB/13777MB (68.2%) swap_used:1984MB swapout:100/s blocked(D):1 running:8 iowait:8.1% steal:0.0% php: 20 procs / 1220MB heaviest user: alison (9 procs, 633MB) apache: 108 procs tcp_estab: 163 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 107 1517 mysql 1 861 root 250 846 alison 6 556 evolution 16 554 mailman 20 245 netdata 8 244 speedlin 4 192 wp-toolkit 3 69 mailnull 3 56 dovenull 6 55 cpanellogin 1 50 named 1 34 dovecot 3 21 polkitd 1 15 lowrange 1 15 candyfabcom 1 14 zabbix 1 10 kurri 1 10 rpc 1 4 --- php workers by user --- USER PROCS RSS_MB alison 7 607 evolution 8 555 speedlin 4 204 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8479 MB Active(file): 3214 MB Inactive(file): 5109 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 605 MB CommitLimit: 10984 MB Committed_AS: 11204 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-05:07:04 5588 /usr/bin/imunify-agent-proxy 4109079 root 1-02:44:42 1764 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-02:44:42 79656 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 887632 2.7 Ssl 11:52:59 /usr/sbin/mariadbd 1218004 1217972 evolution 197908 54.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 166870 1 netdata 181148 2.6 Ssl 05:07:10 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220206 168913 root 175352 0.0 S 04:51:12 spamd child 1218007 1217976 alison 131732 49.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167871 1 root 119248 0.0 Ss 05:07:03 /usr/lib/systemd/systemd-journald 1218017 1217977 alison 113020 41.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1218055 1218020 alison 112572 78.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1218059 1218035 alison 107588 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1218060 1218037 alison 99236 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 168913 1 root 97144 0.0 Ss 05:06:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1218072 1218031 evolution 93580 27.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4109105 4109079 root 79656 2.0 Sl 1-02:44:42 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1218074 1218018 evolution 77352 19.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1218081 1218023 evolution 71912 16.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1218140 1218027 evolution 68000 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1218079 1218021 alison 66984 23.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1218076 1218019 speedlin 60880 23.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1218085 1218033 speedlin 60880 25.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1218084 1218034 speedlin 60848 24.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1218078 1218030 speedlin 60836 23.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1150011 1353308 cpanellogin 51448 0.0 S 20:12 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 1218143 1218024 speedlin 45448 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42104 0.1 Ss 46-04:48:16 cpsrvd (SSL) - waiting for connections 1469 1 root 41852 0.1 Ss 68-21:19:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 40280 0.1 Sl 05:07:05 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 37664 0.0 Ss 05:07:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 166809 1 named 35408 0.0 Ssl 05:07:12 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509236 509098 root 34628 0.0 Sl 9-05:09:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 220207 168913 root 31844 0.0 S 04:51:12 spamd child 167845 1 wp-toolkit 26764 0.0 Ss 05:07:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 24784 0.0 Ss 68-21:19:45 tailwatchd 167896 1 root 24456 0.0 Ss 05:07:02 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1185084 506832 nobody 23652 0.0 S 09:24 /usr/sbin/httpd -k start 1183301 506832 nobody 23496 0.0 S 11:31 /usr/sbin/httpd -k start 1184650 506832 nobody 23124 0.0 S 09:26 /usr/sbin/httpd -k start 1184359 506832 nobody 22188 0.0 S 09:29 /usr/sbin/httpd -k start 1200558 506832 nobody 22008 0.0 S 06:04 /usr/sbin/httpd -k start 1200136 506832 nobody 21952 0.0 S 07:01 /usr/sbin/httpd -k start 508720 1 mailnull 21840 0.0 Ss 9-05:09:57 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1184515 506832 nobody 21696 0.0 S 09:27 /usr/sbin/httpd -k start 1195398 506832 nobody 21652 0.1 S 09:17 /usr/sbin/httpd -k start 167814 1 root 21464 0.0 Ss 05:07:03 lfd - sleeping 1185086 506832 nobody 21060 0.0 S 09:24 /usr/sbin/httpd -k start 1184827 506832 nobody 20940 0.0 S 09:25 /usr/sbin/httpd -k start 167017 1 root 20288 0.1 Ssl 05:07:09 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1217948 508720 mailnull 17836 0.0 S 00:04 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1218013 508720 mailnull 17836 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1217910 506832 nobody 17696 0.0 S 00:07 /usr/sbin/httpd -k start 166757 1 root 17368 0.0 Ss 05:07:13 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 167566 166914 netdata 16908 2.1 Sl 05:07:05 /usr/libexec/netdata/plugins.d/apps.plugin 1 1217909 506832 nobody 16544 0.0 S 00:07 /usr/sbin/httpd -k start 1217934 506832 nobody 16196 0.0 S 00:05 /usr/sbin/httpd -k start 1217920 506832 nobody 16124 0.1 S 00:06 /usr/sbin/httpd -k start 1217979 506832 nobody 16108 0.3 S 00:03 /usr/sbin/httpd -k start 1217973 506832 nobody 16080 0.3 S 00:03 /usr/sbin/httpd -k start 1218029 506832 nobody 16080 0.5 S 00:02 /usr/sbin/httpd -k start 1217978 506832 nobody 16072 0.3 S 00:03 /usr/sbin/httpd -k start 1217971 506832 nobody 16052 0.0 S 00:03 /usr/sbin/httpd -k start 1217967 506832 nobody 16048 0.0 S 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 310646 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 99 evolution/evolutionerp.com.au 15 vinesit/vinesit.com.au-ssl_log 14 aaa/aaadownunder.com.au-ssl_log 12 evolution/evolutionerp.com.au-ssl_log 12 alison/alisonarts.com.au-ssl_log 10 madalice/madalice.com.au-ssl_log 3 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 99 40.115.94.245 66 64.89.160.5 5 118.127.40.55 2 45.158.28.56 1 93.152.223.188 1 87.58.197.139 1 54.236.1.126 1 34.236.41.241 1 34.178.144.55 1 217.181.65.212 1 116.118.68.44 1 114.119.137.101 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 80 GET /api/getItem/LWPB2001KG 12 POST /wp-plain.php 12 GET /wp-content/themes/seotheme/db.php 10 POST /ALFA_DATA/alfacgiapi/perl.alfa 9 GET / 8 GET /wp-content/plugins/fix/up.php 4 POST /wp-cron.php 4 POST /alfacgiapi/perl.alfa 4 GET /wp-content/plugins/apikey/apikey.php 3 GET /wp-login.php 3 GET /plugins/content/apismtp/apismtp.php 2 GET /wp-content/plugins/apikey/apikey.php.suspected 2 GET /api/getItem/PXLG20 1 POST /wp-login.php 1 POST / 1 HEAD / 1 GET /zwihlbqb.php 1 GET /ydfziueq.php 1 GET /tag/hardhat/ 1 GET /store/custom-nike-af1-pink-pastel-flower-kids/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 80 GET /api/getItem/LWPB2001KG 2 GET /api/getItem/PXLG20 1 GET /api/getItem/PXLG50 1 GET /api/getItem/PXLG40 1 GET /api/getItem/PXLG32 1 GET /api/getItem/PXLG25 1 GET /api/getItem/PMG90 1 GET /api/getItem/PMG80 1 GET /api/getItem/PMG65 1 GET /api/getItem/PMG50 1 GET /api/getItem/PMG40 1 GET /api/getItem/PMG32 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:07:28:27 +1000] "GET /api/getItem/PMG40 HTTP/1.1" 200 2432 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:28 +1000] "GET /api/getItem/PMG50 HTTP/1.1" 200 2203 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:28 +1000] "GET /api/getItem/PMG65 HTTP/1.1" 200 1868 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:29 +1000] "GET /api/getItem/PMG80 HTTP/1.1" 200 2200 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:29 +1000] "GET /api/getItem/PMG90 HTTP/1.1" 200 1862 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:28:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" == evolution/evolutionerp.com.au == -- top paths -- 3 POST /wp-plain.php 3 POST /ALFA_DATA/alfacgiapi/perl.alfa 3 GET /wp-content/themes/seotheme/db.php 3 GET /wp-content/plugins/fix/up.php 3 GET / -- last 10 requests -- 64.89.160.5 - - [06/Sep/2026:07:29:26 +1000] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 301 306 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Ve 64.89.160.5 - - [06/Sep/2026:07:29:26 +1000] "POST /wp-plain.php HTTP/1.1" 301 288 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/6 64.89.160.5 - - [06/Sep/2026:07:29:26 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 301 311 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko 64.89.160.5 - - [06/Sep/2026:07:29:26 +1000] "GET / HTTP/1.1" 301 276 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari 64.89.160.5 - - [06/Sep/2026:07:29:26 +1000] "GET /wp-content/plugins/fix/up.php HTTP/1.1" 301 305 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" 64.89.160.5 - - [06/Sep/2026:07:29:27 +1000] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 301 306 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Ve 64.89.160.5 - - [06/Sep/2026:07:29:27 +1000] "POST /wp-plain.php HTTP/1.1" 301 288 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/6 64.89.160.5 - - [06/Sep/2026:07:29:27 +1000] "GET / HTTP/1.1" 301 276 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari 64.89.160.5 - - [06/Sep/2026:07:29:27 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 301 311 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko 64.89.160.5 - - [06/Sep/2026:07:29:29 +1000] "GET /wp-content/plugins/fix/up.php HTTP/1.1" 301 305 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36" == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 POST /wp-plain.php 2 POST /ALFA_DATA/alfacgiapi/perl.alfa 2 GET /wp-content/themes/seotheme/db.php 1 POST /alfacgiapi/perl.alfa 1 POST / 1 GET /wp-login.php 1 GET /wp-content/plugins/fix/up.php 1 GET /wp-content/plugins/apikey/apikey.php.suspected 1 GET /wp-content/plugins/apikey/apikey.php 1 GET /plugins/content/apismtp/apismtp.php 1 GET / -- last 10 requests -- 64.89.160.5 - - [06/Sep/2026:07:29:22 +1000] "GET / HTTP/1.1" 403 17006 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safa 64.89.160.5 - - [06/Sep/2026:07:29:22 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 403 17006 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gec 64.89.160.5 - - [06/Sep/2026:07:29:22 +1000] "GET /wp-content/plugins/apikey/apikey.php?test=hello HTTP/1.1" 403 17006 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Geck 64.89.160.5 - - [06/Sep/2026:07:29:23 +1000] "POST /alfacgiapi/perl.alfa HTTP/1.1" 403 17006 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4. 64.89.160.5 - - [06/Sep/2026:07:29:23 +1000] "GET /plugins/content/apismtp/apismtp.php?test=hello HTTP/1.1" 403 17006 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko 64.89.160.5 - - [06/Sep/2026:07:29:22 +1000] "GET /wp-content/plugins/fix/up.php HTTP/1.1" 404 27678 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.3 64.89.160.5 - - [06/Sep/2026:07:29:23 +1000] "POST /wp-plain.php HTTP/1.1" 403 13 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60 64.89.160.5 - - [06/Sep/2026:07:29:23 +1000] "GET /wp-content/plugins/apikey/apikey.php.suspected?test=hello HTTP/1.1" 403 17006 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, 64.89.160.5 - - [06/Sep/2026:07:29:23 +1000] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 403 17006 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) 118.127.40.55 - - [06/Sep/2026:07:29:23 +1000] "POST /?wordfence_syncAttackData=1788643762.5743 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://www.vinesit.com.au" --- last 30 samples (run-up to this incident) --- 2026-09-06 07:27:09 L1=1.53 run=1 blk=1 avail=10684(77.5%) swpO=0 conn=1 myRSS=845 php=4 phpRSS=24 ap=14 tcp=24 topuser=root 2026-09-06 07:27:09 L1=1.53 run=3 blk=1 avail=10677(77.5%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=65 ap=14 tcp=24 topuser=evolution 2026-09-06 07:27:19 L1=1.52 run=1 blk=1 avail=10689(77.6%) swpO=0 conn=1 myRSS=845 php=4 phpRSS=24 ap=14 tcp=24 topuser=root 2026-09-06 07:27:19 L1=1.52 run=1 blk=1 avail=10688(77.6%) swpO=0 conn=1 myRSS=845 php=4 phpRSS=24 ap=14 tcp=24 topuser=root 2026-09-06 07:27:29 L1=1.44 run=2 blk=1 avail=10498(76.2%) swpO=0 conn=2 myRSS=845 php=5 phpRSS=231 ap=14 tcp=25 topuser=madalice 2026-09-06 07:27:29 L1=1.44 run=2 blk=1 avail=10467(76.0%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=268 ap=14 tcp=25 topuser=madalice 2026-09-06 07:27:39 L1=1.37 run=1 blk=1 avail=10581(76.8%) swpO=0 conn=2 myRSS=845 php=5 phpRSS=157 ap=14 tcp=23 topuser=madalice 2026-09-06 07:27:39 L1=1.37 run=1 blk=1 avail=10579(76.8%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=157 ap=14 tcp=23 topuser=madalice 2026-09-06 07:27:49 L1=1.39 run=2 blk=1 avail=10477(76.0%) swpO=0 conn=2 myRSS=845 php=6 phpRSS=302 ap=13 tcp=23 topuser=alison 2026-09-06 07:27:49 L1=1.39 run=1 blk=1 avail=10592(76.9%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=157 ap=13 tcp=23 topuser=madalice 2026-09-06 07:27:59 L1=1.33 run=1 blk=1 avail=10706(77.7%) swpO=0 conn=2 myRSS=845 php=4 phpRSS=24 ap=13 tcp=23 topuser=root 2026-09-06 07:27:59 L1=1.33 run=1 blk=1 avail=10705(77.7%) swpO=0 conn=1 myRSS=845 php=4 phpRSS=24 ap=13 tcp=23 topuser=root 2026-09-06 07:28:09 L1=1.35 run=1 blk=1 avail=10589(76.9%) swpO=0 conn=2 myRSS=845 php=5 phpRSS=157 ap=13 tcp=24 topuser=madalice 2026-09-06 07:28:09 L1=1.35 run=1 blk=1 avail=10588(76.8%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=157 ap=13 tcp=24 topuser=madalice 2026-09-06 07:28:19 L1=1.30 run=2 blk=1 avail=10570(76.7%) swpO=0 conn=2 myRSS=845 php=5 phpRSS=179 ap=13 tcp=23 topuser=madalice 2026-09-06 07:28:19 L1=1.30 run=1 blk=1 avail=10570(76.7%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=179 ap=13 tcp=23 topuser=madalice 2026-09-06 07:28:29 L1=1.25 run=2 blk=1 avail=10566(76.7%) swpO=0 conn=1 myRSS=845 php=6 phpRSS=216 ap=13 tcp=23 topuser=madalice 2026-09-06 07:28:29 L1=1.25 run=1 blk=1 avail=10570(76.7%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=178 ap=13 tcp=23 topuser=madalice 2026-09-06 07:28:39 L1=1.44 run=2 blk=1 avail=10524(76.4%) swpO=0 conn=1 myRSS=845 php=6 phpRSS=261 ap=13 tcp=22 topuser=madalice 2026-09-06 07:28:39 L1=1.44 run=1 blk=1 avail=10572(76.7%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=179 ap=13 tcp=22 topuser=madalice 2026-09-06 07:28:49 L1=1.37 run=1 blk=1 avail=10567(76.7%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=179 ap=13 tcp=22 topuser=madalice 2026-09-06 07:28:49 L1=1.37 run=1 blk=1 avail=10567(76.7%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=179 ap=13 tcp=22 topuser=madalice 2026-09-06 07:28:59 L1=1.39 run=3 blk=1 avail=10634(77.2%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=111 ap=13 tcp=21 topuser=madalice 2026-09-06 07:28:59 L1=1.39 run=2 blk=1 avail=10584(76.8%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=160 ap=13 tcp=21 topuser=madalice 2026-09-06 07:29:09 L1=1.41 run=2 blk=1 avail=10484(76.1%) swpO=0 conn=1 myRSS=845 php=6 phpRSS=289 ap=13 tcp=23 topuser=olympic 2026-09-06 07:29:09 L1=1.41 run=2 blk=1 avail=10482(76.1%) swpO=0 conn=1 myRSS=845 php=6 phpRSS=289 ap=13 tcp=23 topuser=olympic 2026-09-06 07:29:19 L1=1.35 run=1 blk=1 avail=10596(76.9%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=156 ap=13 tcp=19 topuser=madalice 2026-09-06 07:29:19 L1=1.35 run=2 blk=1 avail=10595(76.9%) swpO=0 conn=1 myRSS=845 php=5 phpRSS=156 ap=13 tcp=19 topuser=madalice 2026-09-06 07:29:29 L1=1.46 run=8 blk=1 avail=9400 (68.2%) swpO=100 conn=15 myRSS=861 php=20 phpRSS=1220 ap=108 tcp=163 topuser=alison 2026-09-06 07:29:29 L1=1.46 run=15 blk=2 avail=9100 (66.1%) swpO=100 conn=1 myRSS=861 php=20 phpRSS=1265 ap=108 tcp=180 topuser=alison